Here is a simplified type of message:
msg = 03;00;00;00;00;54;D5;15;DC;CA;FF;05;A7;00;01
As you can see, the messages are just a bunch of bytes separated by semicolons. The thing is that sometimes a group of these bytes represents a single field in elasticsearch, so the spliting needs to be scripted.
In this example i would compare the first byte ('03') to a specific value, if that checks then i would proceed to split the message in the following manner:
msg 1 = 03;00;00;00;00
msg 2 = 54;D5;15;DC;CA
msg 3 = FF;05;A7;00;01
Note: the start and end of each msg may vary, and i can determine those positions using 'if' clauses (the values checked aren't important, they are in each submessage and i only need to look for the 'first byte' of each one).
After splitting the event, i need to assign new fields to each submessage in a scripted way (by using 'if' clauses, processing the bytes inside). All the messages will have the same fields, but the value of each one may be obtained in different ways.
At this point i will have, theoretically, a list of different messages ready to be sent to elasticsearch.
I hope that helps