title: Split a message using grok
body: <p>I have logs in the format:</p>
  
  <pre><code>2018-09-17 15:24:34;Count of files in error folder in;C:\Scripts\FOLDER\SUBFOLDER\error;1
  </code></pre>
  
  <p>I want to put in a separate field the path to the folder and the number after.
  Like </p>
  
  <pre><code>dirTEST=C:\Scripts\FOLDER\SUBFOLDER\
  count.of.error.filesTEST=1
  </code></pre>
  
  <p>or</p>
  
  <pre><code>dir=C:\Scripts\FOLDER\SUBFOLDER\
  count.of.error.files=1
  </code></pre>
  
  <p>I use for this grok pattern in logstash config:</p>
  
  <pre><code>if  "TestLogs" in [tags] {
      grok{
      match =&gt; { "message" =&gt; "%{DATE:date_in_log}%{SPACE}%{TIME:time.in.log};%{DATA:message.text.log};%{WINPATH:dir};%{INT:count.of.error.files}" }
      add_field =&gt; { "dirTEST" =&gt; "%{dir}" } 
      add_field =&gt; { "count.of.error.filesTEST" =&gt; "%{count.of.error.files}" }
      }
  
  }
  </code></pre>
  
  <p>No errors in logstash logs.</p>
  
  <p>But in the Kibana I get the usual log without new fields.
  <a href="https://i.stack.imgur.com/8jm0a.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/8jm0a.png" alt="enter image description here"></a></p>