Splitting a data field into two

Elastic Stack Elasticsearch
1

Hello, i need to split a certain datafield I have into two separate fields. The field goes like this,

xx-xx0000:XXXXXxxx

where x's are letters and 0's are numbers.

I need to separate the field where the semicolon is but I haven't been able to figure out how to to do that yet. I've looked through the grok documentation but didn't find anything on separating based on a certain character.

Thanks.

2

Since you mention grok I guess this is really a logstash question. A filter with something like will do it.

mutate { split => { "message" => ":" } }

You probably want to replace message with whatever field you want to split, then maybe move the two array elements into their own fields.

3

How would I send the two new items into two new fields?

Thanks

4

Use mutate's add_field to reference the array entries that split returned.

mutate {
        add_field => {
                "firstPart" => "%{[message][0]}"
                "secondPart" => "%{[message][1]}"
        }
}

Again message would be replaced by the field name that you are splitting.

5

Wow, great. Thank you very much for your help!

6

Fixed error in my response. Please read the updated version.

1 Like
7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.