Search code examples
splitlogstashelastic-stackelk

Elastic search's Logstash Mutate Split is not working

I'm having trouble splitting the string type field(target) in logstash.

"log" => {
"address"  =>  "0.0.0.1",
"target" => "hello.exe - PID: 3005 - Module: nthdll.dll"
}

I try to divide by "-" and this is my code :

mutate {
  copy => { "[log][target]" => "targetList" }
  split => { "targetList" =>  "-" }
}

but it is not working, "targetList" is copied, but the splits are not working.

"targetList" => "hello.exe - PID: 3005 - Module: nthdll.dll"

Please give me some advice.

Solution

  • mutate does operations in a fixed order, and split comes before copy, so the targetList field does not exist at the point when the split runs. Split it into two mutates

    mutate { copy => { "[log][target]" => "targetList" } } 
mutate { split => { "targetList" =>  "-" } }

    Please tag this as answering your problem if it solves your problem.