Logstash filtering for field with multiline

Hello People,

I hope you're doing well!

I need your support to parse and index properly the following data coming from JSON (so it's only an extract of the desired data): "text": "Input:\nFieldA - DataA\nFieldB - DataB"

With standard human reading/comprehension (but also my original source and view of Kibana ^^):
Input:
FieldA - DataA
FieldB - DataB

So I need to index:

  • FieldA with the DataA value
  • FieldB with the DataB value...

As it's too easy like that (even if I don't have success until now ^^) the FieldX are dynamic (mean can't anticipate which field name I'll have) but I'm lucky because only text are expected as values :slight_smile:

I tried to work on filter level with kv and mutate but without success as I've feild recorded but split in chaotique way:
if "Input:" in [text] {
mutate {
copy => { "text" => "input" }
gsub => [
"input","Input:",""
]
}
kv {
source => "input"
field_split => "\n"
value_split => " - "
}
}

Do you think that I must move on Ruby fr that or with the simple feature of logstash and filter it will work?
Additionnaly if you have some guidance to provide it will be much appreciated :slight_smile:

Thanks in advacne and enjoy your day!

Guillain

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.