# \*\*URGENT\*\* - Need help to extract fields

**URL:** <https://discuss.elastic.co/t/urgent-need-help-to-extract-fields/167361>\
**Category:** Logstash\
**Created:** [February 6, 2019, 10:02pm UTC](https://discuss.elastic.co/t/urgent-need-help-to-extract-fields/167361 "2019-02-06T22:02:31Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![vdely](https://avatars.discourse-cdn.com/v4/letter/v/8dc957/32.png) [@vdely](https://discuss.elastic.co/u/vdely)\
**Post date:** [February 6, 2019, 10:02pm UTC](https://discuss.elastic.co/t/urgent-need-help-to-extract-fields/167361/1 "2019-02-06T22:02:31Z")

</div>

Hi Techs and experts,

```
 I need help to configure logstash to extract the fields from a log file which has multiple lines like the following :

```

\<134\>Agent\_Local\_Date="2019.01.11" Agent\_Local\_Time="1/11/2019 4:07:06 AM" Agent\_UTC\_Date="2019.01.11" Agent\_UTC\_Time="1/11/2019 3:07:06 AM" Application="firesvc.exe" Classification\_Content\_Pattern="" Classification\_Frequency="" Classification\_Policy="" Classification\_Rule="" Classification\_Type="" Computer\_Name="france-ad\AFR648087" Computer\_Type="0" Custom\_Computer\_Group="Groups\ATTR-Win7" Custom\_Date\_1="" Custom\_Date\_2="" Custom\_Date\_3="" Custom\_Date\_4="" Custom\_Int\_1="" Custom\_Int\_2="" Custom\_Int\_3="" Custom\_Int\_4="" Custom\_String\_1="" Custom\_String\_2="" Custom\_String\_3="" Custom\_String\_4="" Custom\_String\_5="" Custom\_String\_6="" Day\_of\_Week="6" Dll\_Base="" Dll\_Created\_Local\_Time="" Dll\_Load\_Local\_Time="" Dll\_Load\_UTC\_Time="1/11/2019 3:07:06 AM"

each key is already named and I need to create fields with the same name using the value into quotes.  
I also need to get the time values extracted as timestamp and not only string.  
So I'll probably need multiple operations to be achieved by Logstash but I don't know how to do it.

Your expertise will be really appreciated 😉

Thank you very much

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [February 6, 2019, 10:07pm UTC](https://discuss.elastic.co/t/urgent-need-help-to-extract-fields/167361/2 "2019-02-06T22:07:54Z")

</div>

```
    mutate { gsub => ["message", "^<[0-9]+>", "" ] }
    kv { }

```

You can use a date filter to extract time values as timestamps. There are hundreds of examples in this forum.

---

<div class="post-metadata">

**Author:** ![vdely](https://avatars.discourse-cdn.com/v4/letter/v/8dc957/32.png) [@vdely](https://discuss.elastic.co/u/vdely)\
**Post date:** [February 7, 2019, 9:30am UTC](https://discuss.elastic.co/t/urgent-need-help-to-extract-fields/167361/3 "2019-02-07T09:30:23Z")

</div>

@Badger : thank you very much, helped a lot. I found to manage the date filter and it seems working fine !

thank you very much

Vincent

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 7, 2019, 9:30am UTC](https://discuss.elastic.co/t/urgent-need-help-to-extract-fields/167361/4 "2019-03-07T09:30:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.