Hello, I have some IDS logs coming into Graylog, I am trying to split the fields out to report using: let m = split("\\|", to_string($message.message)); set_field("ts", m[0]); set_field("uid", m[1]); The logs fields are separated by a tab, whats the best way of getting these into associated field…

Pipeline - Tab Split

jochen (Jochen) January 17, 2018, 1:11pm 2

Do you have examples of these messages you could share?

Multi value field

Topic		Replies	Views
Pipeline Rules and "Split" Graylog Central (peer support) pipeline-rules	5	3372	October 31, 2017
Pipeline - Split and Extract Graylog Central (peer support)	6	3277	February 23, 2018
Can Someone Help me Graylog Central (peer support) pipeline-rules	5	468	July 20, 2022
Pipeline rule to split log messages into key-value fields not working Graylog Central (peer support) pipeline-rules , sidecar , filebeat-linux	21	3934	September 15, 2022
Parsing Logs On Graylog Graylog Central (peer support)	8	8337	November 17, 2017