Split One Lined "Message" field information


In my dynamic syslogs in eleasticsearch, A fields called "messages" has over 7 lines of data, I need to split that single line into different field. I have a special character "\r\n" before required split information

example my JSON message

"message": "Incoming Text : \r\n Pepe Jeans \r\n Model 123456 \r\n Red \r\n Women \r\n 2019 Italy \r\n 6 foot,Blue,stripes,fasion \r\n 2 "

I'm expecting to split this data each into different fields like
field1: Pepe Jeans
field2: Model 123456
field3: Red
field4: Women
field5: 2019 Italy
field6: 6 foot,Blue,stripes,fasion
field7: 2

Hi @Jennifer_Coley,
You don't say how you are processing that field, but seems like using the split feature of mutate might fit the bill.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.