# Split Logfiles
**URL:** https://discuss.elastic.co/t/split-logfiles/137766
**Category:** Logstash
**Created:** [June 28, 2018, 8:56am UTC](https://discuss.elastic.co/t/split-logfiles/137766 "2018-06-28T08:56:14Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@A.Klos](https://discuss.elastic.co/u/A.Klos)
#### Post date: [June 28, 2018, 8:56am UTC](https://discuss.elastic.co/t/split-logfiles/137766/1 "2018-06-28T08:56:14Z")
Hi,
we have following logformat:
2018-03-15 11:20:46|Field1|Field2|Field3|Field4|Field5|Field6
2018-03-15 11:30:46|Field1| |Field3| |Field5|Field6
How could I split this into fields?
currently my grok pattern (not all fields ):
match =\> ["message" , "%{TIMESTAMP\_ISO8601:timestamp}|%{WORD:field1}|%{WORD:field2}|%{WORD:field3}|%{WORD:field4}|%{GREEDYDATA:msg}"]
Some Fields also could be empty.
How do I split those logs into seperate fields?
Regards
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [June 28, 2018, 11:10am UTC](https://discuss.elastic.co/t/split-logfiles/137766/2 "2018-06-28T11:10:14Z")
You may find the dissect filter easier to use in this case.
---
### Author:  [@A.Klos](https://discuss.elastic.co/u/A.Klos)
#### Post date: [June 28, 2018, 11:46am UTC](https://discuss.elastic.co/t/split-logfiles/137766/3 "2018-06-28T11:46:36Z")
I think it would be possible by split:
mutate{
split =\> {"message" =\> "|"}
}
Output is now:
[0] Field1
[1] Field2
[2] Field3
and so on
If I try to add [1] into a field I got grokparsefailure
add\_field =\> ["received\_from", "%{message}[3]" ]
What's wrong?
---
### Author:  [@A.Klos](https://discuss.elastic.co/u/A.Klos)
#### Post date: [June 28, 2018, 12:29pm UTC](https://discuss.elastic.co/t/split-logfiles/137766/4 "2018-06-28T12:29:02Z")
Not it looks working:
if [type] == "FilePluginInput" {
grok {
```
match => ["message" , "%{TIMESTAMP_ISO8601:timestamp}\|%{GREEDYDATA:nachricht}"]
}
mutate{
split => {"nachricht" => "|"}
add_field => ["severity", "%{[nachricht][7]}" ]
add_field => ["msg", "%{[nachricht][9]}" ]
```
}
date {
match =\> ["timestamp", "yyyy-MM-dd HH:mm:ss"]
timezone =\> ["Europe/Berlin"]
target =\> "@timestamp"
}
}
}
Because whe have 2 differnt seperators (; and |), would it be possible using if then else statement?
If seperator = "|" then
if [type] == "FilePluginInput" {
grok {
```
match => ["message" , "%{TIMESTAMP_ISO8601:timestamp}\|%{GREEDYDATA:nachricht}"]
}
mutate{
split => {"nachricht" => "|"}
add_field => ["severity", "%{[nachricht][7]}" ]
add_field => ["msg", "%{[nachricht][9]}" ]
```
}
date {
match =\> ["timestamp", "yyyy-MM-dd HH:mm:ss"]
timezone =\> ["Europe/Berlin"]
target =\> "@timestamp"
}
}
}
else
if [type] == "FilePluginInput" {
grok {
```
match => ["message" , "%{TIMESTAMP_ISO8601:timestamp}\|%{GREEDYDATA:nachricht}"]
}
mutate{
split => {"nachricht" => ";"}
add_field => ["severity", "%{[nachricht][7]}" ]
add_field => ["msg", "%{[nachricht][9]}" ]
```
}
date {
match =\> ["timestamp", "yyyy-MM-dd HH:mm:ss"]
timezone =\> ["Europe/Berlin"]
target =\> "@timestamp"
}
}
}
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 26, 2018, 12:29pm UTC](https://discuss.elastic.co/t/split-logfiles/137766/5 "2018-07-26T12:29:05Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.