How to split into many fields?

[anragen]

I use nginx ingress controller in kubernetes and all logs is on field "log"

How to split into many fields?

Input logs
14.28.28.9 - admin [08/Mar/2023:02:16:53 +0000] "GET /_next/image?url=https%3A%5B0_1_SyE9Yls.png&w=1920&q=75 HTTP/2.0" 404 57 "https://test2.site.ru/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36" 177 0.037 [test2-website-3000] [] 10.15.139.110:3000 68 0.032 404 496b0c2dc6ec7214bb98142fcd680cf1

in elasticsearch

`{
  "_index": "logstash-2023.03.08",
  "_id": "oigBv4YBrLXTsekl3aEg",
  "_version": 1,
  "_score": 0,
  "_ignored": [
    "log.keyword"
  ],
  "_source": {
    "log": "14.28.28.9 - admin [08/Mar/2023:02:16:53 +0000] \"GET /_next/image?url=ht_SyE9Yls.png&w=1920&q=75 HTTP/2.0\" 404 57 \"https://test2.site.ru/\" \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36\" 177 0.037 [test2-website-3000] [] 10.15.139.110:3000 68 0.032 404 496b0c2dc6ec7214bb98142fcd680cf1\n",
    "stream": "stdout",
    "docker": {
      "container_id": "3a9f0383b02ad6dfde339ac4d81b3d2b6ba367ebd3943634ce620c45a914b868"
    },
    "kubernetes": {
      "container_name": "controller",
      "namespace_name": "test",
      "pod_name": "ingress-test-ingress-nginx-controller-799fdb44cd-sjbvj",
      "container_image": "registry.k8s.io/ingress-nginx/controller@sha256:d1707ca76d3b044ab8a28277a2466a02100ee9f58a86af1535a3edf9323ea1b5",
      "container_image_id": "docker-pullable://registry.k8s.io/ingress-nginx/controller@sha256:d1707ca76d3b044ab8a28277a2466a02100ee9f58a86af1535a3edf9323ea1b5",
      "pod_id": "fe9e6b37-12b2-4754-b7bf-eeeb865865d4",
      "pod_ip": "10.15.137.10",
      "host": "cl1orqfod7ks68fpolno-irik",
      "labels": {
        "pod-template-hash": "799fdb44cd",
        "app_kubernetes_io/component": "controller",
        "app_kubernetes_io/instance": "ingress-test",
        "app_kubernetes_io/name": "ingress-nginx"
      },
      "master_url": "https://10.16.128.1:443/api",
      "namespace_id": "9ac73bcb-9acb-466e-b606-2eae256b656a",
      "namespace_labels": {
        "kubernetes_io/metadata_name": "test"
      }
    },
    "@timestamp": "2023-03-08T02:16:53.331520643+00:00",
    "tag": "kubernetes.var.log.containers.ingress-test-ingress-nginx-controller-799fdb44cd-sjbvj_test_controller-3a9f0383b02ad6dfde339ac4d81b3d2b6ba367ebd3943634ce620c45a914b868.log"
  },
  "fields": {
    "kubernetes.pod_ip": [
      "10.15.137.10"
    ],
    "kubernetes.pod_id.keyword": [
      "fe9e6b37-12b2-4754-b7bf-eeeb865865d4"
    ],
    "stream.keyword": [
      "stdout"
    ],
    "log": [
      "14.28.28.9 - admin [08/Mar/2023:02:16:53 +0000] \"GET /_next/image?url=ht25B0_1_SyE9Yls.png&w=1920&q=75 HTTP/2.0\" 404 57 \"https://test2.site.ru/\" \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36\" 177 0.037 [test2-website-3000] [] 10.15.139.110:3000 68 0.032 404 496b0c2dc6ec7214bb98142fcd680cf1\n"
    ],
    "kubernetes.container_image.keyword": [
      "registry.k8s.io/ingress-nginx/controller@sha256:d1707ca76d3b044ab8a28277a2466a02100ee9f58a86af1535a3edf9323ea1b5"
    ],
    "kubernetes.labels.pod-template-hash": [
      "799fdb44cd"
    ],
    "kubernetes.labels.app_kubernetes_io/component": [
      "controller"
    ],
    "kubernetes.container_image_id.keyword": [
      "docker-pullable://registry.k8s.io/ingress-nginx/controller@sha256:d1707ca76d3b044ab8a28277a2466a02100ee9f58a86af1535a3edf9323ea1b5"
    ],
    "kubernetes.namespace_id": [
      "9ac73bcb-9acb-466e-b606-2eae256b656a"
    ],
    "stream": [
      "stdout"
    ],
    "docker.container_id.keyword": [
      "3a9f0383b02ad6dfde339ac4d81b3d2b6ba367ebd3943634ce620c45a914b868"
    ],
    "kubernetes.container_image": [
      "registry.k8s.io/ingress-nginx/controller@sha256:d1707ca76d3b044ab8a28277a2466a02100ee9f58a86af1535a3edf9323ea1b5"
    ],
    "docker.container_id": [
      "3a9f0383b02ad6dfde339ac4d81b3d2b6ba367ebd3943634ce620c45a914b868"
    ],
    "kubernetes.master_url": [
      "https://10.16.128.1:443/api"
    ],
    "kubernetes.host": [
      "cl1orqfod7ks68fpolno-irik"
    ],
    "tag": [
      "kubernetes.var.log.containers.ingress-test-ingress-nginx-controller-799fdb44cd-sjbvj_test_controller-3a9f0383b02ad6dfde339ac4d81b3d2b6ba367ebd3943634ce620c45a914b868.log"
    ],
    "kubernetes.pod_name.keyword": [
      "ingress-test-ingress-nginx-controller-799fdb44cd-sjbvj"
    ],
    "kubernetes.master_url.keyword": [
      "https://10.16.128.1:443/api"
    ],
    "kubernetes.namespace_name.keyword": [
      "test"
    ],
    "kubernetes.labels.app_kubernetes_io/name": [
      "ingress-nginx"
    ],
    "kubernetes.host.keyword": [
      "cl1orqfod7ks68fpolno-irik"
    ],
    "kubernetes.labels.pod-template-hash.keyword": [
      "799fdb44cd"
    ],
    "kubernetes.labels.app_kubernetes_io/instance": [
      "ingress-test"
    ],
    "kubernetes.labels.app_kubernetes_io/component.keyword": [
      "controller"
    ],
    "kubernetes.container_name": [
      "controller"
    ],
    "kubernetes.pod_ip.keyword": [
      "10.15.137.10"
    ],
    "kubernetes.namespace_labels.kubernetes_io/metadata_name": [
      "test"
    ],
    "kubernetes.labels.app_kubernetes_io/instance.keyword": [
      "ingress-test"
    ],
    "kubernetes.namespace_name": [
      "test"
    ],
    "kubernetes.container_name.keyword": [
      "controller"
    ],
    "@timestamp": [
      "2023-03-08T02:16:53.331Z"
    ],
    "kubernetes.namespace_id.keyword": [
      "9ac73bcb-9acb-466e-b606-2eae256b656a"
    ],
    "kubernetes.labels.app_kubernetes_io/name.keyword": [
      "ingress-nginx"
    ],
    "kubernetes.pod_id": [
      "fe9e6b37-12b2-4754-b7bf-eeeb865865d4"
    ],
    "kubernetes.namespace_labels.kubernetes_io/metadata_name.keyword": [
      "test"
    ],
    "kubernetes.container_image_id": [
      "docker-pullable://registry.k8s.io/ingress-nginx/controller@sha256:d1707ca76d3b044ab8a28277a2466a02100ee9f58a86af1535a3edf9323ea1b5"
    ],
    "kubernetes.pod_name": [
      "ingress-test-ingress-nginx-controller-799fdb44cd-sjbvj"
    ],
    "tag.keyword": [
      "kubernetes.var.log.containers.ingress-test-ingress-nginx-controller-799fdb44cd-sjbvj_test_controller-3a9f0383b02ad6dfde339ac4d81b3d2b6ba367ebd3943634ce620c45a914b868.log"
    ]
  },
  "ignored_field_values": {
    "log.keyword": [
      "14.28.28.9 - admin [08/Mar/2023:02:16:53 +0000] \"GET /_next/image?url=_1_SyE9Yls.png&w=1920&q=75 HTTP/2.0\" 404 57 \"https://test2.site.ru/\" \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36\" 177 0.037 [test2-website-3000] [] 10.15.139.110:3000 68 0.032 404 496b0c2dc6ec7214bb98142fcd680cf1\n"
    ]
  }
}```

[daipom]

The major input plugins support the parser plugin feature. We can use it to parse raw logs.

• https://docs.fluentd.org/parser