Logstash Grok Filter Spit and put in seperate buckets in Elastic Index

Question

Hi I have a log line say like"APPLE" AND "BANANA" AND "MANGO" OR "GRAPES"

I want it to mutate like and split to put in elastic , so elastic should have a equivalent as

options{
    fruits :{
        'APPLE','BANANA','MANGO','GRAPES'
    },
    operators{
        'AND' ,'AND','OR'
    }
}

Is it possible to apply split and put under separate buckets as fruits and operators.

Answer 1

If the problem is "quoted string followed by unquoted string, repeating", I would drop into a ruby{} filter, split on space, examine each word to determine if it's quoted or not, and process as needed.

If not, please expand on your question.