# Logstash tags \_dateparsefailure - How to separate pasted fields or fields together?

**URL:** <https://discuss.elastic.co/t/logstash-tags-dateparsefailure-how-to-separate-pasted-fields-or-fields-together/284318>\
**Category:** Logstash\
**Created:** [September 15, 2021, 7:02pm UTC](https://discuss.elastic.co/t/logstash-tags-dateparsefailure-how-to-separate-pasted-fields-or-fields-together/284318 "2021-09-15T19:02:15Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Cristiane\_Marcarini](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cristiane_marcarini/32/79393_2.png) [@Cristiane\_Marcarini](https://discuss.elastic.co/u/Cristiane_Marcarini)\
**Post date:** [September 15, 2021, 7:02pm UTC](https://discuss.elastic.co/t/logstash-tags-dateparsefailure-how-to-separate-pasted-fields-or-fields-together/284318/1 "2021-09-15T19:02:15Z")

</div>

Hi!  
I have logs that have fields together or fields pasted together, and I don't know how to separate them. Here's a screenshot of how it looks in Kibana and another how it looks in Logstash.  
I need help with this as I'm new around here.  
Thank you very much in advance.

 ![erro dados](https://us1.discourse-cdn.com/elastic/original/3X/7/5/7561b23f413fdd9c3b2004c52c4acc7bd371fc5c.png)  
 ![erro dados log](https://us1.discourse-cdn.com/elastic/original/3X/9/8/9890e7fb03f14eff85cd069a7aa3639be9405aeb.png)

Logstash Code:

```auto
			else if "performanceLog" in [path]
			{
				grok 
				{
					match => {"message" => "(?<timestamp>%{YEAR:year}/%{MONTHNUM:month}/%{MONTHDAY:day}-%{TIME:date}) \| %{USERNAME:username} \| %{DATA:balcao} \| %{DATA:server} \| %{DATA:transaction} \| %{BASE16FLOAT:timed}|%{GREEDYDATA:message}" }
					overwrite => ["message"]
					match => {"message" => "(?<timestamp>%{YEAR:year}/%{MONTHNUM:month}/%{MONTHDAY:day}-%{TIME:date}) \| %{USERNAME:username} \| %{DATA:balcao} \| %{DATA:server} \| %{DATA:transaction}\|%{DATA:identificador} \| %{BASE16FLOAT:timed}|%{GREEDYDATA:message}" }
					overwrite => ["message"]
					match => {"message" => "(?<timestamp>%{YEAR:year}/%{MONTHNUM:month}/%{MONTHDAY:day}-%{TIME:date}) \| %{USERNAME:username} \| %{DATA:balcao} \| %{DATA:server} \| %{DATA:transaction}\|%{DATA:volta}\|(?<timestampperformance>%{YEAR:}/%{MONTHNUM:}/%{MONTHDAY:}-%{TIME:})\|%{DATA:identificador} \| %{BASE16FLOAT:timed}|%{GREEDYDATA:message}" }
				}
				mutate 
				{
					add_field => {
							"transaction" => "%{[transaction][0]}"
							"volta" => "%{[transaction][1]}"
							"timestampperformance" => "%{[transaction][2}"
							"identificador" => "%{[transaction][3]}"
					}
				}	
				ruby 
				{
					code => 'event.set("time", (event.get("timed").to_f))'
				}
			}

```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [September 15, 2021, 8:31pm UTC](https://discuss.elastic.co/t/logstash-tags-dateparsefailure-how-to-separate-pasted-fields-or-fields-together/284318/2 "2021-09-15T20:31:29Z")

</div>

Please do not post pictures of text. They are impossible to search, cannot be copied and pasted, and in your case simply impossible to read due to the poor colour contrast.

---

<div class="post-metadata">

**Author:** ![Cristiane\_Marcarini](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cristiane_marcarini/32/79393_2.png) [@Cristiane\_Marcarini](https://discuss.elastic.co/u/Cristiane_Marcarini)\
**Post date:** [September 15, 2021, 8:55pm UTC](https://discuss.elastic.co/t/logstash-tags-dateparsefailure-how-to-separate-pasted-fields-or-fields-together/284318/3 "2021-09-15T20:55:10Z")

</div>

But have the code, is the same. I put to complete the information. The people can see or not. And the picture I put how the instructions

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [September 15, 2021, 9:15pm UTC](https://discuss.elastic.co/t/logstash-tags-dateparsefailure-how-to-separate-pasted-fields-or-fields-together/284318/4 "2021-09-15T21:15:05Z")

</div>

The problem with the pictures is that it makes impossible to copy anything and try to simulate your pipeline for example, and sometimes it is hard to see and some people may not be able to see it at all.

If I understood correctly you want to extract information from the `transaction` field, right?

To access they way you want to access it in the mutate filter, using index positions, you need first to have a mutate splite on this field.

Try to add this in your pipeline:

```auto
mutate {
    split => { "transaction" => "|" }
}

```

So, if your `transaction` field has the string value of `string1|string2|string3`, the split filter will create an array with those values and you will have `[string1, string2, string3]`.

This will allow you to access the values using the index position, for example `%{[transaction][0]}` will return `string1`.

The `_dateparsefailure` is a tag added by the `date` filter, but you didn't share your date filter, so there is no way to know what could be wrong.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 13, 2021, 9:15pm UTC](https://discuss.elastic.co/t/logstash-tags-dateparsefailure-how-to-separate-pasted-fields-or-fields-together/284318/5 "2021-10-13T21:15:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.