带管道分隔符的日志的Grok模式

Question

我正在尝试找出下面的日志模式的日志模式。

01/02AVDC190001|00001|4483850000152971|DATAPREP|PREPERATION/ENRICHEMENT                 |020190201|20:51:52|SCHED

到目前为止，我尝试过的是：

input {
    file {
        path => "C:/Elasitcity/Logbase/July10_Logs_SDC/*.*"
        start_position => "beginning"
        sincedb_path => "NUL"


        }
      }
filter {
    mutate {
            gsub => ["message","\|"," "]
    }

    grok {
            match => ["message","%{NUMBER:LOGID} %{NUMBER:LOGPHASE} %{NUMBER:LOGID} %{WORD:LOGEVENT} %{WORD:LOGACTIVITY} %{DATE_US: DATE} %{TIME:LOGTIME}"]
    }
}



            }
output  {
    elasticsearch {

                    hosts => "localhost"
                    index => "grokcsv"
                    document_type => "gxs"

                  }
            stdout {}
}

我还想知道是否有可能将数据和时间组合在一起，因为它由流水线字符分隔。但这不是主要问题。