# Logstash how to different format message

**URL:** <https://discuss.elastic.co/t/logstash-how-to-different-format-message/246076>\
**Category:** Logstash\
**Created:** [August 24, 2020, 9:03am UTC](https://discuss.elastic.co/t/logstash-how-to-different-format-message/246076 "2020-08-24T09:03:26Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Champion\_Xie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/champion_xie/32/71770_2.png) [@Champion\_Xie](https://discuss.elastic.co/u/Champion_Xie)\
**Post date:** [August 24, 2020, 9:03am UTC](https://discuss.elastic.co/t/logstash-how-to-different-format-message/246076/1 "2020-08-24T09:03:26Z")

</div>

07/20/20 00:48:28 INFO hello 353 us.(channel/Channel.cpp:575)  
07/20/20 00:48:28 INFO transfercity:bj(city/cityTransferQueryBusiness.cpp:72)  
07/20/20 00:48:29 INFO transferQuery city 965380 us.(channel/Channel.cpp:575)

how to parse match all lines

---

<div class="post-metadata">

**Author:** ![Champion\_Xie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/champion_xie/32/71770_2.png) [@Champion\_Xie](https://discuss.elastic.co/u/Champion_Xie)\
**Post date:** [August 24, 2020, 9:04am UTC](https://discuss.elastic.co/t/logstash-how-to-different-format-message/246076/2 "2020-08-24T09:04:41Z")

</div>

```
filter {
mutate {
    split => ["message"," INFO "]
}

mutate {
    add_field => {
      "srsdate" => "%{[message][0]}"
      "temp1" => "%{[message][1]}"
    }
}

mutate {
  split => ["temp1", "("]
  add_field => {
      "other" => "%{[temp1][1]}"
      "useinfo" => "%{[temp1][0]}"
  }
  remove_field => ["other","message","temp1"]
}

 if [useinfo] =~ ":" {
   mutate {
     add_field => {
         "action" => "%{useinfo[0]}"
         "domain" => "%{useinfo[1]}"
     }
   }
 }
```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 24, 2020, 3:48pm UTC](https://discuss.elastic.co/t/logstash-how-to-different-format-message/246076/3 "2020-08-24T15:48:56Z")

</div>

> [@Champion\_Xie](#):
>
> `"action" => "%{useinfo[0]}"`

That should get you an ambiguous reference error and logstash will likely fail to start. It should be %{[useinfo][0]}, although I do not see where you are actually doing a split on useinfo.

I would do this all using dissect.

```
dissect { mapping => { "message" => "%{ts} %{+ts} %{loglevel} %{messageBit}(%{filename}:%{lineNumber})%{}" } }

```

---

<div class="post-metadata">

**Author:** ![Champion\_Xie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/champion_xie/32/71770_2.png) [@Champion\_Xie](https://discuss.elastic.co/u/Champion_Xie)\
**Post date:** [August 25, 2020, 2:32am UTC](https://discuss.elastic.co/t/logstash-how-to-different-format-message/246076/4 "2020-08-25T02:32:06Z")

</div>

- That's a cool way

Ultimately, if i want to remove Somenum and us. from messageBit, the following code can be implemented, and it's not sure if there's a better solution

filter {  
dissect { mapping =\> { "message" =\> "%{ts} %{+ts} %{loglevel} %{messageBit}(%{})%{}" } }

```
mutate {
    strip => ["messageBit"]
}

if [messageBit] =~ ":" {
  mutate {
    split => ["messageBit",":"]
      add_field => {
        "action" => "%{[messageBit][0]}"
        "domain" => "%{[messageBit][1]}"
      }
  }
} else {
  if [messageBit] =~ " us." {
    mutate {
      split => ["messageBit"," us."]
      add_field => {
         "submsg" => "%{[messageBit][0]}"
     }
   }
mutate {
   split => ["submsg"," "]
     add_field => {
       "subact1" => "%{[submsg][0]}"
       "subact2" => "%{[submsg][1]}"
       "action" => "%{subact1}%{subact2}"
       }

       remove_field => ["subact1","subact2","submsg","loglevel"]
   }
 }

```

}  
}

---

<div class="post-metadata">

**Author:** ![Champion\_Xie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/champion_xie/32/71770_2.png) [@Champion\_Xie](https://discuss.elastic.co/u/Champion_Xie)\
**Post date:** [August 29, 2020, 4:11am UTC](https://discuss.elastic.co/t/logstash-how-to-different-format-message/246076/5 "2020-08-29T04:11:13Z")

</div>

- I look forward to more help @Badger

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 26, 2020, 4:11am UTC](https://discuss.elastic.co/t/logstash-how-to-different-format-message/246076/6 "2020-09-26T04:11:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.