Hello, I have some IDS logs coming into Graylog, I am trying to split the fields out to report using: let m = split("\\|", to_string($message.message)); set_field("ts", m[0]); set_field("uid", m[1]); The logs fields are separated by a tab, whats the best way of getting these into associated field…

Pipeline - Tab Split

jochen (Jochen) January 17, 2018, 1:11pm 2

Do you have examples of these messages you could share?

Multi value field