Regarding Split filter in mutate

[suresh_u]

Hi team,
I have one roll number like 1071-P56790-345.

First number is 1071. Remaining fields in future can be added.
So I need to extract 1071 and P56790-345 into 2 seperate fields.

I tried using filter by delimeter '-'. But array is in the record. Below is the syntax:

mutate {
split => { "doc_number" => "-" }
}

Could someone please suggest how to solve it?

Thanks.

[sudhagar_ramesh]

Hello @suresh_u

You can use grok filter to make it has two separate fields

filter
{
grok
{
match => {"message" => ["doc_number", "%{DATA:firstnumber}-%{GREEDYDATA:lastnumber}"]}
}
}

[suresh_u]

thanks @sudhagar_ramesh let me try.

[suresh_u]

Thanks a lot @sudhagar_ramesh . It is working.