Logstash Parsing Error for Field which contains Spaces

Elastic Stack Logstash
1

Hi

I am trying to parse the below log line by mutating the pipe symbol with space. However some time there are few field value contains some spaces in between(The last field in the example given below) and after parsing that field value is considered as three different fields (i.e.. access, token, expired). How can i solve this issue?

API-PROXY-1|1469599856616|1469599856625|rrt-6e3138e4-eu-15765-5137040-1|123.12.123.123|test-api|Access Token expired|

Logstash Conf:

mutate{
gsub => ["message", "|", " " ]
}

2

Have you tried using the csv filter plugin with '|' specified asseparator?

3

CSV filter plugin would look for a column to do this, in my case the logs are in plain log format. Would I be able to use CSV filter plugin at all?

4

The csv filter parses the line based on a configurable separator, in your case '|' rather than ',' which is normally used for csv files. It should work on the data you provided as an example.

5

Thanks. Its working now.