Logstash-plugin kv useragent question

Elastic Stack Logstash
1

Dear ELK technical experts
I have a basic logstash kv question to ask, experts please help.

message
data1:abcde,;,useragent:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Google-PageRenderer Google (+https://developers.google.com/+/web/snippet/)

---- Logstash conf ----

input{stdin{}}
filter {
kv {
source => "message"
field_split => ",;,"
value_split => ":"
}
}
output{stdout{}}

expected outcome

"data1" => "abcde",
"useragent" => "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Google-PageRenderer Google (+https://developers.google.com/+/web/snippet/)",

actual results

**" like Gecko) Chrome/56.0.2924.87 Safari/537.36 Google-PageRenderer Google (+https"** => "//developers.google.com/+/web/snippet/)",
                                                                            "data1" => "abcde",
                                                                        **"useragent"** => **"Mozilla/5.0 (X11"**
2

The field_split option is a character class, so that will split fields whenever it sees either a comma or a semi-colon. You should use the field_split_pattern option instead.

3

thanks badger

Problem solved, thank you for your help

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.