Dears , kindly i need some help for the below issue --> -In the RAW data file that i am using in filebeat , has variable # of fields , and i need to build the Grok Pattern in logstash. raw data --> 001:2019-04-17 00:00:00 003:201090743559 009:9116435510269278 010: 014:Vodafone 01…

[image] Nabil_Mohamed: 00:00:01\t003:201069393867\t009:3528921046739912\t010:\t014:Vodafone\t015:85\t020:MT\t036:\t049:\t053:369330884,369330885,369330886 Your fields are tab separated, not space separated. So you need to adjust the dissect, mutate+gsub, and kv to match that.

Discuss the Elastic Stack

Variable fields in Logstash's Grok-Pattern

Elastic Stack Logstash

Nabil_Mohamed (nabil mohamed) April 23, 2019, 10:14am 11

-Thanks dear this solve the problem , i make the raw file all is a space separated and
not include any tabs.

thanks dear

Topic		Replies	Views
Pattern Assistance ## Logstash	4	820	July 6, 2017
New fields not being created and grok help Logstash	6	3275	July 6, 2017
I'm just confused in using grok Logstash	10	519	June 21, 2018
Auto Field Detection in Logs Logstash	7	2836	July 6, 2017
Help for parsing Logstash	5	847	July 6, 2017

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Variable fields in Logstash's Grok-Pattern

Related topics