I'm struggling on enrich (split one of field from) CSV file input
in my document I have many of undefined fields so at the begging I've needed to
avoid that value.
so I've decided to use
mutate {
gsub => ["message","undefined-",""]
}
mutate {
gsub => ["message","[-]*undefined",""]
}
but now I need to split one of filed from "berears"
this expression after | it can be repeated many times
:
5-7-undefined-undefined-undefined-undefined-undefined-#0(bearer successful)-5|
7-5-undefined-undefined-undefined-undefined-undefined-#0(bearer successful)-7;
according to head
EPS_BEARER_ID-BEARER_QCI-ARP_PL-ARP_PCI-ARP_PVI-GBR_UL-GBR_DL-BEARER_CAUSE-DEFAULT_BEARER_ID
- how to make an exception for such a field to leave the fields undefined and match within pattern
- how to assign a breakdown of these values to individual fields
- is it possible to enrich after global exception (on the beginning)