Hi, after doing the split filter, so my message was an array ok, so %{[message][0]} %{[message][1]} ... that gives me their value fine. now I have an array of length 30 for example and I start the condition if {} example logstash.conf: filter { mutate { split => {"message" => "|"} } mutate { …

Badger May 17, 2022, 3:51pm 8

If there are a limited number of formats you may be able to count the number of columns and use that to determine which csv filter to use.

Topic		Replies	Views
Find and replace string in [message] field Logstash	9	4773	September 14, 2017
Ruby filter logstash (.length) Logstash	2	220	June 13, 2022
Using field value as value in message[x] Logstash	5	526	June 15, 2022
How to use ruby filter Logstash	2	914	July 6, 2017
Logstash Question Logstash	3	361	May 19, 2017

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Initialize counter in logstash and replace the '%{[message][0]}'?

Related topics