# I need to split the message term field into different terms

**URL:** <https://discuss.elastic.co/t/i-need-to-split-the-message-term-field-into-different-terms/120830>\
**Category:** Kibana\
**Created:** [February 21, 2018, 11:57am UTC](https://discuss.elastic.co/t/i-need-to-split-the-message-term-field-into-different-terms/120830 "2018-02-21T11:57:53Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![DRDL](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/drdl/32/27510_2.png) [@DRDL](https://discuss.elastic.co/u/DRDL)\
**Post date:** [February 21, 2018, 11:57am UTC](https://discuss.elastic.co/t/i-need-to-split-the-message-term-field-into-different-terms/120830/1 "2018-02-21T11:57:53Z")

</div>

![message](https://us1.discourse-cdn.com/elastic/original/3X/7/2/722f46a9c2cf37596cc88126b4007c1d0c8d5705.png)

I need the switch logs to be displayed separately like in the image the whole message field is combined . can i split that message into different fields ?

example:

message : the exact message looks like this :  
10.41.0.3 Feb 21 17:06:14 local7 notice 974 Feb 21 17:10:25.394: %SYS-5-CONFIG\_I: Configured from console by vty1 (10.41.0.244)

I need to customise it to something like this.

message : Configured from console by vty1 (10.41.0.244)  
Ip address: 10.41.0.3  
timestamp : Feb 21 17:06:14   
facility:local7  
priority: info,notice etc

i am using file beat as an agent to ship logs

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [February 21, 2018, 12:01pm UTC](https://discuss.elastic.co/t/i-need-to-split-the-message-term-field-into-different-terms/120830/2 "2018-02-21T12:01:14Z")

</div>

You can parse your log messages either in Logstash or through an [ingest node pipeline](https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest.html) in Elasticsearch. [This blog post](https://www.elastic.co/blog/should-i-use-logstash-or-elasticsearch-ingest-nodes) compares these two options and provides a discussion around pros and cons.

---

<div class="post-metadata">

**Author:** ![DRDL](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/drdl/32/27510_2.png) [@DRDL](https://discuss.elastic.co/u/DRDL)\
**Post date:** [February 21, 2018, 12:12pm UTC](https://discuss.elastic.co/t/i-need-to-split-the-message-term-field-into-different-terms/120830/3 "2018-02-21T12:12:34Z")

</div>

thank you for the quick response i will get back to you after checking

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 21, 2018, 12:12pm UTC](https://discuss.elastic.co/t/i-need-to-split-the-message-term-field-into-different-terms/120830/4 "2018-03-21T12:12:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.