Parsing the string with not specific delimeters


(saisn) #1

I have a field which is of type string and holds a log data from which i need to identify specific fields as below. what could be the best way to do this when string doesn't have a fixed delimiter

"Log": "2016-01-01T00:00:12|DEBUG|89ID:701Task':
ID=701125351 wayID=666 iceID=688 UID=733008 MID=00D089DE DName=null
......................................

the data above is stored in a field called outputdata. I have to read a field like UID=733008 from it. Is there a way in logstash that can read the matching words as UID and save that UID field in a index.


(Christian Dahlqvist) #2

Use a grok filter to first parse out all the fields up to and including the colon. Parse and store the rest in a variable using a GREEDYDATA pattern. You can then apply a kv filter to parse the key-value list.


(saisn) #3

i dont have a fixed length delimiter here some has tab some has few spaces. In kv the default delimeter is " ". how can i fix in such a situation


(Christian Dahlqvist) #4

You could perhaps pre-process the kv list with a mutate gsub filter to replace all tabs with spaces?


(saisn) #5

Sorry, but 'tab' is not a delimiter here.
The delimiter is actually some variable number of spaces.


(system) #6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.