LogStash Special Character Split Error

[leandrojmp (Leandro Pereira)]

This is really weird, I simulated with the same symbol in the pipeline and it worked without any problem.

But I'm on a Linux system and from the output of @aaron-nimocks example, he is on a Mac, which is Unix based, maybe it is something related to how windows is encoding the configuration file, this can give some problems in some cases.

You could try to not use the ∮ char but use its unicode code, you would need to replace it with another character to use in the split filter.

This works:

mutate {
    gsub => ["message","\u222E","|"]
}
mutate {
    split => {"message" => "|"}
}