How to enrich one of field in logtash

I'm struggling on enrich (split one of field from) CSV file input

in my document I have many of undefined fields so at the begging I've needed to
avoid that value.
so I've decided to use

mutate {
		gsub => ["message","undefined-",""]
	}

	mutate {
		gsub => ["message","[-]*undefined",""]
	}

but now I need to split one of filed from "berears"
this expression after | it can be repeated many times
:

5-7-undefined-undefined-undefined-undefined-undefined-#0(bearer successful)-5|
7-5-undefined-undefined-undefined-undefined-undefined-#0(bearer successful)-7;

according to head

EPS_BEARER_ID-BEARER_QCI-ARP_PL-ARP_PCI-ARP_PVI-GBR_UL-GBR_DL-BEARER_CAUSE-DEFAULT_BEARER_ID
  1. how to make an exception for such a field to leave the fields undefined and match within pattern
  2. how to assign a breakdown of these values to individual fields
  3. is it possible to enrich after global exception (on the beginning)

if someone could take a look at this?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.