How to split column which has multpiple values

Elastic Stack Logstash
1

im using it in logfile fields time,sessionid,requestid, fieldvalue columns and my question is inside of fieldvalue column these terms are placed. how to split the createdtime value to individual field (createdby,createdtime ,updatedby,updatedtime,name,etc.,)
grok{
match =>["message","%{NUMBER:TIME} \t %{WORD:SESSIONID} \t %{GREEDYDATA:FieldValue}"]
}

thanks
saravanan.R

2

Hi

You could use a second grok{} filter, placed after the first, where your FieldValue already exists, and extract your "createdby", etc.:

grok {
  match => ["FieldValue", ".... your stuff goes here..."]
}

Hope this helps.

3

thankyou bro i will try it now

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.