Multiple separators when importing CSV files in logstash

[flavienbwk]

Hello,

I have a bunch of CSV files I want to import with each, data of this format :
first_name;last_name

The problem is that sometimes, the format will be :
first_name:last_name (the ; is :)

Is there a way to provide multiple separators in the logstash conf file or will I be forced to process the file before sending it to logstash ?

Maybe it is possible to pass a regular expression in parameter ?

Thank you.

[Badger]

If there are only two fields then you could use a grok filter to parse it

grok { match => { "message" => "^(?<first>[^:;]+)[:;]%{GREEDYDATA:second}" } }

If there are multiple fields it might be better to change the : to ;

mutate { gsub => [ "message", ":", ";" ] }

[flavienbwk]

Thank you for your answer, what about if the second field can contain a ":" or a ";" as its first character ?

[Badger]

The grok will still work. It divides the string at the first occurence of either ; or : regardless of what comes after.