How to enrich one of field in logtash

I'm struggling on enrich (split one of field from) CSV file input

in my document I have many of undefined fields so at the begging I've needed to
avoid that value.
so I've decided to use

mutate {
		gsub => ["message","undefined-",""]

	mutate {
		gsub => ["message","[-]*undefined",""]

but now I need to split one of filed from "berears"
this expression after | it can be repeated many times

5-7-undefined-undefined-undefined-undefined-undefined-#0(bearer successful)-5|
7-5-undefined-undefined-undefined-undefined-undefined-#0(bearer successful)-7;

according to head

  1. how to make an exception for such a field to leave the fields undefined and match within pattern
  2. how to assign a breakdown of these values to individual fields
  3. is it possible to enrich after global exception (on the beginning)

if someone could take a look at this?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.