# Logstash logs want in proper format

**URL:** <https://discuss.elastic.co/t/logstash-logs-want-in-proper-format/303379>\
**Category:** Logstash\
**Created:** [April 27, 2022, 9:46am UTC](https://discuss.elastic.co/t/logstash-logs-want-in-proper-format/303379 "2022-04-27T09:46:46Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![dharminfadia](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dharminfadia/32/119587_2.png) [@dharminfadia](https://discuss.elastic.co/u/dharminfadia)\
**Post date:** [April 27, 2022, 9:46am UTC](https://discuss.elastic.co/t/logstash-logs-want-in-proper-format/303379/1 "2022-04-27T09:46:46Z")

</div>

Hello Everyone

I am recieved message from some alerts and data is look like as belwo I want to set in proper looks can you please help any one ?

type=update&date\_time=2022-04-27T04%3A11%3A06-05%3A00&initiated\_from=admin&initiated\_by=admin&list=0&contact%5Bid%5D=9&contact%5Bemail%5D=sureshb%[40xxx.com](http://40xxx.com)&contact%5Bfirst\_name%5D=suresh&contact%5Blast\_name%5D=Bari&contact%5Bphone%5D=984898456&contact%5Bip%5D=0.0.0.0&contact%5Btags%5D=ContradoCommerce-customer&contact%5Bfields%5D%5B2%5D=Active&contact%5Bfields%5D%5B3%5D=1&contact%5Bfields%5D%5B4%5D=Yes&contact%5Bfields%5D%5B6%5D=%7C%7CDropShipper%7C%7CSeller%7C%7CStudent%7C%7C&contact%5Bfields%5D%5B5%5D=%7C%7CDropShipper%7C%7CSeller%7C%7CStudent%7C%7C&contact%5Bfields%5D%5B0%5D=Locked&contact%5Bfields%5D%5B8%5D=17-09-2021&contact%5Bfields%5D%5B9%5D=cdouk&contact%5Bcustomer\_acct\_name%5D=&contact%5Borgname%5D=&customer\_acct\_name=&customer\_acct\_id=0&orgname=&\_url=%2Fin.php

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [April 29, 2022, 1:06am UTC](https://discuss.elastic.co/t/logstash-logs-want-in-proper-format/303379/2 "2022-04-29T01:06:03Z")

</div>

Do you mean you want to separate all of these into their own field, using the `&` as a field separator?

---

<div class="post-metadata">

**Author:** ![dharminfadia](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dharminfadia/32/119587_2.png) [@dharminfadia](https://discuss.elastic.co/u/dharminfadia)\
**Post date:** [April 29, 2022, 4:35am UTC](https://discuss.elastic.co/t/logstash-logs-want-in-proper-format/303379/3 "2022-04-29T04:35:37Z")

</div>

@warkolm  
**Thank you for Reply**

Yes you got exect point how can I achive that using logstash.?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [May 1, 2022, 11:36pm UTC](https://discuss.elastic.co/t/logstash-logs-want-in-proper-format/303379/4 "2022-05-01T23:36:34Z")

</div>

Take a look at the CSV or dissect filters.

---

<div class="post-metadata">

**Author:** ![dharminfadia](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dharminfadia/32/119587_2.png) [@dharminfadia](https://discuss.elastic.co/u/dharminfadia)\
**Post date:** [May 3, 2022, 8:25am UTC](https://discuss.elastic.co/t/logstash-logs-want-in-proper-format/303379/5 "2022-05-03T08:25:36Z")

</div>

@warkolm

Thank you sir Give me Quick response

Solve this problem using KV and Mutate filter

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 31, 2022, 8:25am UTC](https://discuss.elastic.co/t/logstash-logs-want-in-proper-format/303379/6 "2022-05-31T08:25:57Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.