Splitting message log

Elastic Stack Logstash
1

Hello,

When I am collecting logs from Syslog and transferring those logs to kibana using filebeat, I am getting a tab named by message in row format as below mention:

Capture
Capture940×214 31.7 KB

I want this to be in a separate field like below mention so I can create the dashboard.

_gateway date=2022-01-07
time=02:43:13
devname="AXYY"
devid="FG201ETK19901061"
logid="00000"
type="traffic"
subtype="forward"
level="notice"
vd="root"
eventtime=1648272
tz="+0800"
srcip=192.168.12.12
srcname="XY"

Is there any way to split these logs?

2

Hey !

You can surely use the KV filter plugin consider you dont use logstash you might want to setup an Elasticsearch ingest pipeline with filter processor like

{
  "kv": {
    "field": "message",
    "field_split": " ",
    "value_split": "="
  }
}
1 Like
3

Everything is working fine except the field split, I m not able to add whitespce in field_split. Please see the below mention screenshot. Can you please look into this and confirm what possible action I can perform?

image

4

Hey,

I think you should read the bottom of your screenshot, as it is told a space it typically enclosed in " "

1 Like
5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.