Remove text on field

Elastic Stack Logstash
1

hello,
I have a csv file like this

2018-07-17 06:01:18 ID:784514|FD: ....
As you can see it's missing a "|" between date/time and ID so first field is saw like a text

I want that first field is a date/time and other field like 'id'

How i can they to logstast to put first field in date/time and ID like a other field ?

rgds

2

Insert the |, then use a csv filter

mutate { gsub => [ "message", "^([^ ]+ [^ ]+) ", "\1|" ] }
3

ths for reply :

i have done this :

mutate {

split => { "message" => "ID:" }
add_field => {
"TimeStamp" => "%{[message][0]}"
"ID" => "%{[message][1]}"

}

and seems working

4

but i don't have _source with all fields

ideas ?

5

thanks !

it's better