hello guys, i'm trying to send logs from a syslog-ng server to logstash and logstash to elasticsearch, but all events are coming in the message field. Is it possible to separate these events to create a new field for each thing?

You could try dissect { mapping => { "message" => "<%{syslogPri}>%{[@metadata][ts]} %{+[@metadata][ts]} %{+[@metadata][ts]} %{ip} %{[@metadata][restOfLine]}" } } date { match => [ "[@metadata][ts]", "MMM dd HH:mm:ss" ] } kv { source => "[@metadata][restOfLine]" field_split => "|" } No…

Discuss the Elastic Stack

How to strip events from message field? Logstash syslog

Elastic Stack Logstash

Badger July 20, 2021, 7:23pm 6

I will answer here, rather than in this duplicate thread.

Topic		Replies	Views
Parsing data from the message field of incoming json Logstash	2	626	September 14, 2017
Parse "message" field on Syslog Logstash	4	1405	March 28, 2021
Parsing system.syslog with pipeline logs-system.syslog-1.54.0 Elastic Observability	2	132	March 20, 2024
Parsing Logstash Message Fields Logstash	6	433	April 26, 2021
Elastic Json parse into logstash Logstash	30	1202	November 22, 2018

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

How to strip events from message field? Logstash syslog

Related topics