Seperate dynamic comma seperated field into multiple fields

Elastic Stack Logstash
1

Apologies I am new to ELK and Logstash so this may be a simple solution.
I have a field that is currently in the elk stack, it is passing through Logstash. The field is dynamic in that is can have any number of values. The values are text that are comma separated. I need the field to be split, with the values being passed new fields
example input field: [ server1, server2, server3, server4]

output needed: [server1field] = server1
[server2field] = server1
[server3field] = server1
[server4field] = server1
Any help is appreciated

2

Use mutate+split to convert a string to an array. If you need to clean up whitespace you could use mutate+gsub before splitting the string or a ruby filter that calls the ruby String strip function after.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.