Multiple separators when importing CSV files in logstash


I have a bunch of CSV files I want to import with each, data of this format :

The problem is that sometimes, the format will be :
first_name:last_name (the ; is :)

Is there a way to provide multiple separators in the logstash conf file or will I be forced to process the file before sending it to logstash ?

Maybe it is possible to pass a regular expression in parameter ?

Thank you.

If there are only two fields then you could use a grok filter to parse it

grok { match => { "message" => "^(?<first>[^:;]+)[:;]%{GREEDYDATA:second}" } }

If there are multiple fields it might be better to change the : to ;

mutate { gsub => [ "message", ":", ";" ] }
1 Like

Thank you for your answer, what about if the second field can contain a ":" or a ";" as its first character ?

The grok will still work. It divides the string at the first occurence of either ; or : regardless of what comes after.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.