How to dissect uneven space in log with filebeat processors-CodePudding

I have a python microservice that output logs like so:

INFO    ; 2022-12-02 01:30:00; bla bla bla...
DEBUG   ; 2022-12-02 01:30:00; bla bla bla...

Note how the space is different on the loglevel. I am parsing it like so:

                    - dissect:
                        tokenizer: "%{log.level}    ;%{ timestamp} ; %{?message}"
                        field: "message"
                        target_prefix: ""

Which work for the first line, not the second. Anyone know if there is a solution for such case?

Thank you.

CodePudding user response：

You need to use the right-padding modifier

                         add this
                           || 
- dissect:                 vv
    tokenizer: "%{log.level->};%{ timestamp} ; %{?message}"
    field: "message"
    target_prefix: ""