# Siebel Workflow Monitor Log

**URL:** <https://discuss.elastic.co/t/siebel-workflow-monitor-log/196840>\
**Category:** Logstash\
**Created:** [August 26, 2019, 8:48pm UTC](https://discuss.elastic.co/t/siebel-workflow-monitor-log/196840 "2019-08-26T20:48:29Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Thiago\_Paiva](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thiago_paiva/32/52326_2.png) [@Thiago\_Paiva](https://discuss.elastic.co/u/Thiago_Paiva)\
**Post date:** [August 26, 2019, 8:48pm UTC](https://discuss.elastic.co/t/siebel-workflow-monitor-log/196840/1 "2019-08-26T20:48:29Z")

</div>

Hi, I have string extracted by "multiline" and it looks like below:

```
"massage": "ts_action: 2019-08-23 01:22:14, Action ID: 1-13RK8A8Z, ts_action: 2019-08-23 01:22:14, Action ID: 1 + 1CU2 + 93, ts_action : 2019 -08-23 01:22:14, Action ID: 1-AZYY5O, ts_action: 2019-08-23 01:22:14, Action ID: 1-122RF15J "

```

I want to send the value of "massage" in the fields:

Ts\_action1 = 2019-08-23 01:22:14

Action\_id1 = 1-13RK8A8Z

Ts\_action2 = 2019-08-23 01:22:14

Action\_id2 = 1+1CU2+93

Ts\_action3 = 2019-08-23 01:22:14

Action\_id3 = 1-AZYY5O

Ts\_action4 = 2019-08-23 01:22:14

Action\_id4 = 1-122RF15J

I know the ruby ​​plugin might be a solution, but I'm not familiar with ruby.

Thank you for your attention and help.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 26, 2019, 10:40pm UTC](https://discuss.elastic.co/t/siebel-workflow-monitor-log/196840/2 "2019-08-26T22:40:20Z")

</div>

Please edit your post, select the data

"massage": "ts\_action: 2019-08-23 01:22:14, stock ID: 1-13RK8A8Z, ts\_action: 2019-08-23 01:22:14, stock ID: 1 + 1CU2 + 93, ts\_action : 2019 -08-23 01:22:14, Action ID: 1-AZYY5O, ts\_action: 2019-08-23 01:22:14, Action ID: 1-122RF15J "

and click on \</\> in the toolbar above the edit pane. Make sure it starts looking like

```
"massage": "ts_action: 2019-08-23 01:22:14, stock ID: 1-13RK8A8Z, ts_action: 2019-08-23 01:22:14, stock ID: 1 + 1CU2 + 93, ts_action : 2019 -08-23 01:22:14, Action ID: 1-AZYY5O, ts_action: 2019-08-23 01:22:14, Action ID: 1-122RF15J "

```

in the preview pane on the right.

How can we know that 1-AZYY5O should be left out of the result set?

---

<div class="post-metadata">

**Author:** ![Thiago\_Paiva](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thiago_paiva/32/52326_2.png) [@Thiago\_Paiva](https://discuss.elastic.co/u/Thiago_Paiva)\
**Post date:** [August 27, 2019, 2:36pm UTC](https://discuss.elastic.co/t/siebel-workflow-monitor-log/196840/3 "2019-08-27T14:36:42Z")

</div>

Thanks,

I already did it.

So, I already corrected the text! The "1-AZYY5O" isn't the left out. All key and values need to be set result.

I tried aother solution with KV. And now I have:

```
 "action_id" => [
        [0] "1-13RK8A8Z",
        [1] "1+1CU2+93",
        [2] "1-AZYY5O",
        [3] "1-122RF15J"

   "ts_action" => [
    [0] "2019-08-23 01:25:07",
    [1] "2019-08-23 01:25:07",
    [2] "2019-08-23 01:25:07",
    [3] "2019-08-23 01:25:07",
    [4] "2019-08-23 01:25:07"

```

But, I'd need to replace in an unique field yet!

I used the code:

```
ruby {
    code => '
      action = event.get["ts_action"]
        action.each_index { |i| event["ts_action{action[i]}"] = action[i] }
    '
  }

```

But the result was:

```
[1] "_rubyexception"
```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 27, 2019, 3:17pm UTC](https://discuss.elastic.co/t/siebel-workflow-monitor-log/196840/4 "2019-08-27T15:17:18Z")

</div>

Try this. scan returns an array of arrays, each of which contains the capture groups from the regexp.

```
    ruby {
        code => '
            matches = event.get("massage").scan(/ts_action\s*: ([^,]+), Action ID: ([^,]+)/)
            matches.each_index { |x|
                event.set("ts_action#{x+1}", matches[x][0])
                event.set("action_id#{x+1}", matches[x][1])
            }
        '
    }
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 24, 2019, 3:17pm UTC](https://discuss.elastic.co/t/siebel-workflow-monitor-log/196840/5 "2019-09-24T15:17:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.