# Parser un fichier text avec logstash

**URL:** <https://discuss.elastic.co/t/parser-un-fichier-text-avec-logstash/220676>\
**Category:** Logstash\
**Created:** [February 24, 2020, 2:28pm UTC](https://discuss.elastic.co/t/parser-un-fichier-text-avec-logstash/220676 "2020-02-24T14:28:09Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![fatfall](https://avatars.discourse-cdn.com/v4/letter/f/90db22/32.png) [@fatfall](https://discuss.elastic.co/u/fatfall)\
**Post date:** [February 24, 2020, 2:28pm UTC](https://discuss.elastic.co/t/parser-un-fichier-text-avec-logstash/220676/1 "2020-02-24T14:28:09Z")

</div>

bonjour,  
j'ai un fichier .txt que je dois ingérer dans logstash pour l'intégrer sur elasticsearch;  
voici un extait du fichier:  
{"\_index":"logs-2010.11.27","\_type":"doc","\_id":"xcA","\_score":null,"\_source":{"app\_name":"selfcare-b2c-conso","@timestamp":"2019-11-27T00:00:00.006Z","message":"Check for : 4750506"},"sort":[800006]}  
et je dois recuperer les element dans message comme le text "Check authorization for : 776320506" le champ sort  
j'ai crer mon fichier conf mais je n'y arrive pas voici ce que j'ai fais:

input {  
file {  
path =\> "/home/fatouthink/Bureau/tout/docs stage/tp2/logstash.txt"  
start\_position =\> "beginning"  
}  
}  
filter {  
mutate {  
split =\> ["message", " "]  
add\_field =\> { "message\_fields" =\> "%{message[0]}" }  
}  
grok {  
match=\>{  
"message"=\>"%{NOTSPACE:bloc}%{TIMESTAMP\_ISO8601:time}%{WORD:method}%{IP:clientip}|%{GREEDYDATA}"  
}  
}  
date{ match =\> ["timestamp" , "dd/MMM/yyyy:HH:mm:ss Z"]}

```
}

```

output {

```
 stdout { codec => rubydebug }

```

}

---

<div class="post-metadata">

**Author:** ![ITIC](https://avatars.discourse-cdn.com/v4/letter/i/90ced4/32.png) [@ITIC](https://discuss.elastic.co/u/ITIC)\
**Post date:** [February 25, 2020, 7:52am UTC](https://discuss.elastic.co/t/parser-un-fichier-text-avec-logstash/220676/2 "2020-02-25T07:52:28Z")

</div>

Hi

Given your input data example, you could add `codec => "json"` ([https://www.elastic.co/guide/en/logstash/7.6/codec-plugins.html](https://www.elastic.co/guide/en/logstash/7.6/codec-plugins.html)) to your `file{}` input plugin, that should give you all the variables as you need them, except for `_source`, that will still be a dictiionary.

Then, on your `filter{}` section, coment out your `mutate{}` and `grok{}` filters and try the [`json{}`](https://www.elastic.co/guide/en/logstash/current/plugins-filters-json.html) filter, with `source => "_source"`. This should give you all the fields.

Hope this helps.

---

<div class="post-metadata">

**Author:** ![fatfall](https://avatars.discourse-cdn.com/v4/letter/f/90db22/32.png) [@fatfall](https://discuss.elastic.co/u/fatfall)\
**Post date:** [February 25, 2020, 9:12am UTC](https://discuss.elastic.co/t/parser-un-fichier-text-avec-logstash/220676/3 "2020-02-25T09:12:07Z")

</div>

thank i will try to use your method

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 24, 2020, 9:12am UTC](https://discuss.elastic.co/t/parser-un-fichier-text-avec-logstash/220676/4 "2020-03-24T09:12:09Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.