hello,
I have a csv file like this
2018-07-17 06:01:18 ID:784514|FD: ....
As you can see it's missing a "|" between date/time and ID so first field is saw like a text
I want that first field is a date/time and other field like 'id'
How i can they to logstast to put first field in date/time and ID like a other field ?
rgds
Badger
July 23, 2018, 2:35pm
2
Insert the |, then use a csv filter
mutate { gsub => [ "message", "^([^ ]+ [^ ]+) ", "\1|" ] }
ths for reply :
i have done this :
mutate {
split => { "message" => "ID:" }
add_field => {
"TimeStamp" => "%{[message][0]}"
"ID" => "%{[message][1]}"
}
and seems working
but i don't have _source with all fields
ideas ?
system
(system)
Closed
August 20, 2018, 3:32pm
6
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.