Parsing of field which have dynamic number of subfield

[swapnali]

hi,

I am trying to parse NAS logs,in that i have field "to" in to there are number of receiver address and my logs are streaming logs. so i cant predict how many receiver address will be there in that field

how to parse such kind of data
below are the value of my field
<a.com>,<b.com>...... so on

thanks

[logger (Malte Leek)]

for this we need more detail of the log.

but if these are the values of one field. then you could use the gsub filter and replace the "<" and ">" and create an array then elasticsearch will save all values in one field.

https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-gsub

and https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-replace
to add brackets at the beginning and at the end.
mutate { replace => { "field" => "[%{field}]" } }

[Badger]

You can use mutate+split to convert that to an array.

[swapnali]

Thanks It works
mutate {
split => {"field_name" => "," }
}