Logstash 8.5.2 how to parse special character in a string value

Elastic Stack Logstash
1

Parsing a value of string field http://127.0.0.1:27336/notify
logstash maps in Elastic search index many values for the original string.
In this case values are http, 127.0.0.1, 27336 and notify.
When it encounters the characters : and / splits the original string.
While in output I expect to see the string as it arrives in input: http://127.0.0.1:27336/notify.
This is my logstash.conf

input {
    beats {
        port => 5042
    }
}
output {
    elasticsearch {
        hosts => ["http://XX.X.X.XXX:XXXX"]
        index => "example"
		user => "user"
		password => "password"
    }
}

Is there a filter that allows me to ignore these special characters?

2

It is not clear what is your issue, the Logstash pipeline you shared does not have any filter, so it will not parse or change your message in any way.

Please share a sample of your source message and also the output of the same message you are getting in Elasticsearch.

3

my source message is http://127.0.0.1:27336/notify

In output I have
http
127.0.0.1
27336
notify

I would like to have this output:
http://127.0.0.1:27336/notify

What filter should I use to get the desired output?

4

You need to share your message and the output Logstash is giving to you, it is not possible to understand your issue without this.

Are you using Filebeat, right? The file that Filebeat is reading has a line where you have only this http://127.0.0.1:27336/notify as a message?

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.