I need to split the message term field into different terms

I need the switch logs to be displayed separately like in the image the whole message field is combined . can i split that message into different fields ?


message : the exact message looks like this : Feb 21 17:06:14 local7 notice 974 Feb 21 17:10:25.394: %SYS-5-CONFIG_I: Configured from console by vty1 (

I need to customise it to something like this.

message : Configured from console by vty1 (
Ip address:
timestamp : Feb 21 17:06:14
priority: info,notice etc

i am using file beat as an agent to ship logs

1 Like

You can parse your log messages either in Logstash or through an ingest node pipeline in Elasticsearch. This blog post compares these two options and provides a discussion around pros and cons.

thank you for the quick response i will get back to you after checking

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.