Hey,
here are two solutions:
Solution 1: Getting all fields:
Two Extractors, first a GROK to remove syslog-header (actually, why is it in there?), second a Copy-Input with csv-converter.
The GROK Extractor:
The Copy-Input with CSV To Fields converter
Note: In the field names attribute, there are 29 fields needed, since the csv is 29 columns wide. Use appropriate names if they are known for better readability.
This is the result:
Solution 2: Only 20th (n th) field.
Use a Split and Index Extractor, that splits on “,” (comma) and set the target index to 20.
The result:
Greetings - Phil
PS: For your convenience: value1,value2,value3,value4,value5,value6,value7,value8,value9,value10,value11,value12,value13,value14,value15,value16,value17,value18,value19,value20,value21,value22,value23,value24,value25,value26,value27,value28,value29