How to cut syslog/sophos filebeat output into pieces?

Elastic Stack Kibana
1

Hello all,

I'm completely new to Elastic/ELK.

Currently I'm playing arround with some syslog output from a Sophos UTM network firewall.
I successfully get the data via filebeat module for sophos into the stack.

But most of the logoutput is in one string and not cut into pieces like I need it.

Below in the screenshot you can see the event.original field in which is every data.

filebeat_sophos
filebeat_sophos2164×991 111 KB

How can I cut this into pieces?

Regards
3lastic

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.