Parsing of field which have dynamic number of subfield


I am trying to parse NAS logs,in that i have field "to" in to there are number of receiver address and my logs are streaming logs. so i cant predict how many receiver address will be there in that field

how to parse such kind of data
below are the value of my field
<>,<>...... so on


for this we need more detail of the log.

but if these are the values of one field. then you could use the gsub filter and replace the "<" and ">" and create an array then elasticsearch will save all values in one field.

to add brackets at the beginning and at the end.
mutate { replace => { "field" => "[%{field}]" } }

You can use mutate+split to convert that to an array.


Thanks It works
mutate {
split => {"field_name" => "," }

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.