I want to split from filed value using logstash

Elastic Stack Logstash
1

@warkolm @Badger help me....

Hello Everyone

I am trying to split recipient-status feild first 3 digit and want to add in to new feild I tried mutate split and add filed but no luck can any one suggest how I can achive this ???

Sample logs

05/01/23 23:59:57 SMTP-OU 0CAB49668DD74D988109ASDEDFA0E602.MAI 1796 0.0.0.0 CONN 220 docomo.ne.jp ESMTP Service Ready 0 38 =?utf-8?B?44GC44Gq44Gf44Gu54Sh5paZ44Gu5q+N44Gu5pel44Kq44O8?=

Logstash Configuration

input {
stdin { }
}

filter {
csv {
separator => " "
columns => ["datetime","transactiontype","messageid","remoteport","remoteip","smtocommand1","smtpcommand2","recipient-status","BytesRecv","BytesSent","column11","subject"]
}
}

filter {
mutate {
remove_field => ["[event][original]"]

remove_field => ["message"]

}
}

filter {
mutate {
gsub => [
"subject", "=?\w{3}-\d?\w?.*", ""

]
}
}

filter{
mutate {
split => { "recipient-status" => "\d{3}" }
add_field => { "statuscode" => "%{[recipient-status][0]}"}
}
}

output {
stdout {
codec => rubydebug
}
}

2

Have you try grok? Because if you aply the split by spaces it will fail your sample data have more spaces that columns.

With grok you can use regular expresions to mach and catch the data with all your requirements

3

Hello @cperzrt10

Thank you for reply

I tried first with grok pattern but the problem is my file having 40-50 lacs raw and all every time detect new pattern so I choose this option this thing is split with tab and count as csv
delimetter but I want to perfrom so field slipt and that value I want to add in to new feild so any one have Idea they can help me..

4

@dharminfadia please don't ping people that aren't already taking part in your topic like that.

5

Ok thank you for reply

6

But you dont indicate the tab in the split filter you put space

filter {
  csv {
    separator => " "
    columns => ["datetime","transactiontype","messageid","remoteport","remoteip","smtocommand1","smtpcommand2","recipient-status","BytesRecv","BytesSent","column11","subject"]
  }
}

I think that the tab separator is

separator => "	"
7

@cperzrt10

Thank you for reply

Actully for CSV filter \t is not working we have to manually tab between quots so that's the reason I metnion instead of \t to tab so it is showing space..

8

Can you post the sample post using the blockquote option to see the tabs?

9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.