# Logstash filter with separator " \_"
**URL:** https://discuss.elastic.co/t/logstash-filter-with-separator/263675
**Category:** Logstash
**Created:** [February 9, 2021, 5:44am UTC](https://discuss.elastic.co/t/logstash-filter-with-separator/263675 "2021-02-09T05:44:51Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@vik1](https://discuss.elastic.co/u/vik1)
#### Post date: [February 9, 2021, 5:44am UTC](https://discuss.elastic.co/t/logstash-filter-with-separator/263675/1 "2021-02-09T05:44:52Z")
Hello, I am using logstash to collect data from FortiGate. I have one special field to check the number of connections per day. This "vpn" field looks like sz\_forti, szec\_forti. I need to take the first characters before \_ (for example sz\_forti -\> sz) in order to test them with a pattern and then group them. How can you do this? (in python, you can split by separator and make an array from a string, but since I'm new to elasticsearch this became a problem for me)
Full code of conf.d
> ```
> input {
> udp {
> port => 5517
> type => "forti_log"
> }
> }
>
>
> filter {
> if [type] == "forti_log" {
> kv {
> source => "message"
> exclude_keys => ["type", "subtype"] }
> geoip { source => "dst" }
> geoip { source => "dstip" }
> geoip { source => "src" }
> geoip { source => "srcip" }
>
> mutate {
>
> rename => ["dst", "dst_ip"]
> rename => ["dstip", "dst_ip"]
> rename => ["dstport", "dst_port"]
> rename => ["devname", "device_id"]
> rename => ["status", "action"]
> rename => ["src", "src_ip"]
> rename => ["srcip", "src_ip"]
> rename => ["zone", "src_intf"]
> rename => ["srcintf", "src_intf"]
> rename => ["srcport", "src_port"]
> rename => ["rcvd", "byte_recieved"]
> rename => ["rcvdbyte", "bytes_recieved"]
> rename => ["sentbyte", "bytes_sent"]
> rename => ["sent", "bytes_sent"]
> convert => ["bytes_recieved", "integer"]
> convert => ["bytes_sent", "integer"]
> remove_field => ["msg"]
> }
>
> ```
```
if [filter by delimiter must be here, for example for an input sz_teplov -> sz -> add_field ["Energetic"] [sczv_vedom -> sczv -> add_field ["MGBD"]]]
```
> ```
> }
> }
>
> output {
> if [type] == "forti_log" {
> elasticsearch {
> hosts => "localhost:9200"
> index => "forti-%{+YYYY.MM.dd}"
> }
> }
> }
>
> ```
---
### Author:  [@kavierkoo](https://discuss.elastic.co/u/kavierkoo)
#### Post date: [February 9, 2021, 11:27am UTC](https://discuss.elastic.co/t/logstash-filter-with-separator/263675/2 "2021-02-09T11:27:29Z")
Hi Vik,
If I understand your question correctly,
I could thought of using GROK to split the field, and then use if else statement to mutate + add\_field accordingly
```
grok {
match => ["vpn", "%{GREEDYDATA:fieldname}\_"]
}
if "sz" in [fieldname] {
mutate and add_field
}
```
sczv\_vedom
```
{
"fieldname": [
"sczv"
]
}
```
sz\_teplov
```
{
"fieldname": [
"sz"
]
}
```
szec\_forti
```
{
"fieldname": [
"szec"
]
}
```
Hope this helps you!!
---
### Author:  [@vik1](https://discuss.elastic.co/u/vik1)
#### Post date: [February 9, 2021, 11:40am UTC](https://discuss.elastic.co/t/logstash-filter-with-separator/263675/3 "2021-02-09T11:40:28Z")
Thank you, can I use grok inside my kv filter?
---
### Author:  [@kavierkoo](https://discuss.elastic.co/u/kavierkoo)
#### Post date: [February 9, 2021, 12:47pm UTC](https://discuss.elastic.co/t/logstash-filter-with-separator/263675/4 "2021-02-09T12:47:45Z")
Sorry, I am not sure about this too ☹
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 9, 2021, 12:48pm UTC](https://discuss.elastic.co/t/logstash-filter-with-separator/263675/5 "2021-03-09T12:48:04Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.