# How to cut syslog/sophos filebeat output into pieces?

**URL:** <https://discuss.elastic.co/t/how-to-cut-syslog-sophos-filebeat-output-into-pieces/274301>\
**Category:** Kibana\
**Created:** [May 28, 2021, 8:19am UTC](https://discuss.elastic.co/t/how-to-cut-syslog-sophos-filebeat-output-into-pieces/274301 "2021-05-28T08:19:06Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![3lastic](https://avatars.discourse-cdn.com/v4/letter/3/47e85d/32.png) [@3lastic](https://discuss.elastic.co/u/3lastic)\
**Post date:** [May 28, 2021, 8:19am UTC](https://discuss.elastic.co/t/how-to-cut-syslog-sophos-filebeat-output-into-pieces/274301/1 "2021-05-28T08:19:06Z")

</div>

Hello all,

I'm completely new to Elastic/ELK.

Currently I'm playing arround with some syslog output from a **Sophos UTM** network firewall.  
I successfully get the data via **filebeat module for sopho** s into the stack.

But most of the logoutput is in one string and not cut into pieces like I need it.

Below in the screenshot you can see the **event.original** field in which is every data.

 ![filebeat_sophos](https://us1.discourse-cdn.com/elastic/original/3X/7/0/707658c678b0620880fc6371be5dbd7e1850c6a7.png)

How can I cut this into pieces?

Regards  
3lastic

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 25, 2021, 8:19am UTC](https://discuss.elastic.co/t/how-to-cut-syslog-sophos-filebeat-output-into-pieces/274301/2 "2021-06-25T08:19:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.