Kv filter: a number added in the beginning of the field

Elastic Stack Logstash
1

This is my conf file:

input {
  file {
    start_position => "beginning"
    path => [ "/home/taraka/Projects/neonion/logs/*.log" ]
    type => "syslog"
  }
}

filter{

  multiline {
	    pattern => "\[\#\|\d{4}"
	    negate => true
     what => "previous"
    }
   grok {
    match   =>  [ "message", "(?<highlight_created>(highlight_created))"]
    break_on_match => false
    }
   grok {
    match   =>  [ "message", "(?<highlight_deleted>(highlight_deleted))"]
    break_on_match => false
    } 

   kv {
    source => "message"
    field_split => ","
    value_split => "="
     }
}
output {
  if[type]=="syslog"{
    elasticsearch {host => "localhost"}
    stdout { codec => rubydebug}
  }
}

and the output looks like this:

Screenshot from 2016-02-19 18:21:32.png723×260 33.9 KB

I need to have the field comment_created without the number beside. How can I do it?

2

Hi,

You should first use something like:

       grok {
          match => [ "message", "%{TIMESTAMP_ISO8601:timestamp} %{GREEDYDATA:logmessage}"]
       }

Then use the following to split on the comma:

kv {
   source => logmessage
   etc...
3

@msimos Thank you very much! it works!