How to parse the field value in logstash? - elasticsearch

Question

I have logstash in which I am getting data from HTTP API but there is a field for which I need to parse the value from this
"ServiceProvider": "T:ISP | CIR:450Mbps BR:1Gbps | VD:Beq | CID:124"
to this
"ServiceProvider": "T:ISP"
"CIR": "450Mbps"
"BR": "1Gbps"
"VD": "Beq"
"CID": "124"
My config file for Logstash is:
input{
http_poller {
urls => {
"ISP" => {
method => get
url => "http://xyz:8080/api"
headers => {
Accept => "application/json"
}
}
}
request_timeout => 60
tags => "hourly"
schedule => { cron => "30 * * * *"}
codec => "json"
metadata_target => "meta"
}
}
filter {
mutate {
remove_field => [ "[meta][request][auth][user]", "[meta][request][auth][pass]","[meta][request][headers][Accept]" ]
}
}
output {
elasticsearch {
hosts => ["http://xyz:9100"]
index => "xyz"
}
}
Thanks in advance!!

Answer 1

I would leverage the dissect filter and kv filter like this:
filter {
dissect {
mapping => {
"message" => "%{ServiceProvider} | %{[#metadata][kv]}"
}
}
kv {
source => "[#metadata][kv]"
field_split => "| "
value_split => ":"
}
mutate {
remove_field => [ "[meta][request][auth][user]", "[meta][request][auth][pass]","[meta][request][headers][Accept]" ]
}
}