logstash解析报文空格合并

下面是我的logstash的配置，其实就是split一下，取到上面的部分  # For detail config for log4j as input,
  # See: https://www.elastic.co/guide/e ... .html
  beats {
#    mode => "server"
    host => "192.168.75.31"
    port => 5044
  }
}
filter { 
       date {
    match => ["message","UNIX_MS"]
    target => "@timestamp"
  }
 ruby {
   code => "event.set('timestamp', event.get('@timestamp').time.localtime + 8*60*60)"
 }
 ruby {
   code => "event.set('@timestamp',event.get('timestamp'))"
 }
 mutate {
   remove_field => ["timestamp"]
 }
        mutate{
        split=>["message"," [H2_LOG]: "]
                add_field => {
                        "field1" => "%{[message][0]}"
                }
                add_field => {
                        "field2" => "%{[message][1]}"
                }
                            }
        json {
                source => "field2"
                target => "log"
              }
        mutate{
          remove_field => "message"
          remove_field => "field1"      
          remove_field => "field2"      
         }
} 
output {
    #if "_jsonparsefailure" not in [tags] {
    elasticsearch {
        hosts => ["192.168.75.25:9200","192.168.75.26:9200","192.168.75.27:9200"]
        index => "applogtest"
                  }
     #}
}