# Split problem in logstash
**URL:** https://discuss.elastic.co/t/split-problem-in-logstash/96545
**Category:** Logstash
**Created:** [August 10, 2017, 4:27am UTC](https://discuss.elastic.co/t/split-problem-in-logstash/96545 "2017-08-10T04:27:25Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@abu.sayeed](https://discuss.elastic.co/u/abu.sayeed)
#### Post date: [August 10, 2017, 4:27am UTC](https://discuss.elastic.co/t/split-problem-in-logstash/96545/1 "2017-08-10T04:27:25Z")
my logstash.conf
filter {
mutate {
remove\_field =\> ["type", "tags", "input\_type", "@version", "beat", "offset"]
}
}
my discovery logs format:
@timestamp:August 8th 2017, 13:45:54.424 host:vNTDACLSnTALK01 source:/home/local/group/nazdaq/logs/naztech.log message:[INFO] Status =\> SENT | client : [MTB] | cell : [1746710009] | message-delivery-time : [2017-08-07 09:46:27,807] | Operator: [GP]
Available field:
@timestamp
message
host message
source
I need available field:
@timestamp
message
host message
source
status
client
operator
What can I do? Please anybody help me.
thanks
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 10, 2017, 6:01am UTC](https://discuss.elastic.co/t/split-problem-in-logstash/96545/2 "2017-08-10T06:01:11Z")
Change your grok filter so it lists two expressions instead of one (there's an example in the grok filter docs). Let the first expression be a copy if your current expression but with `%{GREEDYDATA:syslog_message}` replaced with a more specific expression that extracts the fields you want. If you do this, Logstash will try to match against the first expression and as a fallback try the more generic expression (because presumably not all log messages will be of the type contaiing status, client, and operator).
---
### Author:  [@abu.sayeed](https://discuss.elastic.co/u/abu.sayeed)
#### Post date: [August 10, 2017, 7:35am UTC](https://discuss.elastic.co/t/split-problem-in-logstash/96545/3 "2017-08-10T07:35:32Z")
filter {
mutate {
remove\_field =\> ["type", "tags", "input\_type", "@version", "beat", "offset"]
add\_field =\> ["status", "client", "operator", "message\_delivery\_time"]
}
}
log\_format
**@timestamp** :August 8th 2017, 13:45:54.424 **host** :vNTDACLSnTALK01 **source** :/home/local/group/nazdaq/logs/naztech.log **message** :[INFO] Status =\> SENT | client : [MTB] | cell : [1746710009] | message-delivery-time : [2017-08-07 09:46:27,807] | Operator: [GP] **operator** :message\_delivery\_time **status** :client
available\_field:
t @timestamp
t message
t host message
t source
? operator
? status
But I need:
log\_format
**@timestamp** :August 8th 2017, 13:45:54.424 **host** :vNTDACLSnTALK01 **source** :/home/local/group/nazdaq/logs/naztech.log **message** :[INFO] Status =\> SENT | client : [MTB] | cell : [1746710009] | message-delivery-time : [2017-08-07 09:46:27,807] | Operator: [GP] **operator** :[GP] **status** :sent **client** : MTB **message\_delivery\_time** :2017:32:30
t @timestamp
t message
t host message
t source
t operator
t status
t client
t message\_delivery\_time
I need help
thanks
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 7, 2017, 7:35am UTC](https://discuss.elastic.co/t/split-problem-in-logstash/96545/4 "2017-09-07T07:35:46Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.