# Is it possible to parse ISO 8583 into Elasticsearch using logstash

**URL:** <https://discuss.elastic.co/t/is-it-possible-to-parse-iso-8583-into-elasticsearch-using-logstash/308633>\
**Category:** Elasticsearch\
**Created:** [July 1, 2022, 7:57am UTC](https://discuss.elastic.co/t/is-it-possible-to-parse-iso-8583-into-elasticsearch-using-logstash/308633 "2022-07-01T07:57:01Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Zerra\_Triani](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zerra_triani/32/105901_2.png) [@Zerra\_Triani](https://discuss.elastic.co/u/Zerra_Triani)\
**Post date:** [July 1, 2022, 7:57am UTC](https://discuss.elastic.co/t/is-it-possible-to-parse-iso-8583-into-elasticsearch-using-logstash/308633/1 "2022-07-01T07:57:01Z")

</div>

I want to monitor a log containing ISO 5853, I have succeeded in parsing the ISO log into single line, then how do I parse it according to ISO 5853 standards? Is there a plugin program or something else that can fit it into elastic? Thank you

This the example ISO data in single line

```auto
0210F33840098A81840000000000040000041660349402371542770110000001000000000224101000000000004280881010000224601101110011034510645000500048142808800ATM15104012FT20055TKLCM3600201002360C034426916973107004089434003451

```

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [July 1, 2022, 1:53pm UTC](https://discuss.elastic.co/t/is-it-possible-to-parse-iso-8583-into-elasticsearch-using-logstash/308633/2 "2022-07-01T13:53:34Z")

</div>

You need to provide more context about what is ISO 8583, what this logs means and what you want to extract from it.

Also, it is 8583 or 5853?

For what I understood, it is a message where each position can represent a field or an information, if so, the only thing that would help you parse this is the `ruby` filter in Logstash.

You would need to write a ruby script that would slice your string and get the information for each position, but I think that it is easier to do this outside Logstash, write some tool your preferred language to parse the file and them give logstash the parsed file to consume.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 29, 2022, 1:53pm UTC](https://discuss.elastic.co/t/is-it-possible-to-parse-iso-8583-into-elasticsearch-using-logstash/308633/3 "2022-07-29T13:53:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.