Search code examples
logstashgroklogstash-grok

Multi-value fields only store last value

I'm relatively new to ELK and grok. I'm trying to parse a log file that may contain 1 or more repetitions of the same value. For example the log file could contain:

value1;value2;value3;

value1;

value1;value2;value3;value4;........value900;

For this example, I'm using the following grok pattern:

((?[a-z0-9]*)[;])+

This appears to work properly, and parse each value. The problem is that the "tag" field only contains the last value (ie value900). All of the previous values seem to be overwritten.

Is there a way to gather all of the values and store them into an array instead of only getting the last value?

Solution

  • Simply use mutate:

    mutate {
  split => ["tag",";"]
}

    This will split the value that's in the tag field into an array. So just match the whole string in your grok ((?<tag>[a-z0-9;]+) and then split it from there.