I use dissect plugin for this esample of data file:
--- begin file ---
14.76.162.112 # 2018-04-01
--- end file ---
With this filter
filter {
dissect {
mapping => {
"message" => "%{ip} # %{date}"
}
}
}
This is the result
{"@timestamp":"2018-04-16T21:21:31.972Z","message":"112.111.191.14\t\t\t # 2018-04-07, "ip":"112.111.191.14\t\t\t","date":"2018-04-07"}
How can I remove the tab character?