Remove text on field

hello,
I have a csv file like this

2018-07-17 06:01:18 ID:784514|FD: ....
As you can see it's missing a "|" between date/time and ID so first field is saw like a text

I want that first field is a date/time and other field like 'id'

How i can they to logstast to put first field in date/time and ID like a other field ?

rgds

Insert the |, then use a csv filter

mutate { gsub => [ "message", "^([^ ]+ [^ ]+) ", "\1|" ] }

ths for reply :

i have done this :

mutate {

split => { "message" => "ID:" }
add_field => {
"TimeStamp" => "%{[message][0]}"
"ID" => "%{[message][1]}"

}

and seems working

but i don't have _source with all fields

ideas ?

thanks !

it's better

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.