How to split column which has multpiple values

im using it in logfile fields time,sessionid,requestid, fieldvalue columns and my question is inside of fieldvalue column these terms are placed. how to split the createdtime value to individual field (createdby,createdtime ,updatedby,updatedtime,name,etc.,)
match =>["message","%{NUMBER:TIME} \t %{WORD:SESSIONID} \t %{GREEDYDATA:FieldValue}"]



You could use a second grok{} filter, placed after the first, where your FieldValue already exists, and extract your "createdby", etc.:

grok {
  match => ["FieldValue", ".... your stuff goes here..."]

Hope this helps.

thankyou bro i will try it now

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.