# Best approach to split arrays of objects?

**URL:** <https://discuss.elastic.co/t/best-approach-to-split-arrays-of-objects/195567>\
**Category:** Logstash\
**Created:** [August 16, 2019, 9:47pm UTC](https://discuss.elastic.co/t/best-approach-to-split-arrays-of-objects/195567 "2019-08-16T21:47:13Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![daniel\_a](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/daniel_a/32/48390_2.png) [@daniel\_a](https://discuss.elastic.co/u/daniel_a)\
**Post date:** [August 16, 2019, 9:47pm UTC](https://discuss.elastic.co/t/best-approach-to-split-arrays-of-objects/195567/1 "2019-08-16T21:47:13Z")

</div>

I've been trying to ingest audit logs from Google Cloud, but the logs contain several arrays of objects. What would be the best way to split the arrays? Let's say if there are 10-20 different arrays, not in a single log but across the whole data source, what would be the best way to approach this problem? Right now, I tried if/else statements, but this is becoming a pain.

Here is my previous post which shows if/else statements:

> [@Split Module Multiple If Else Statements](https://discuss.elastic.co/t/split-module-multiple-if-else-statements/195275):
>
> I've been trying to ingest audit cloud logs, and they contain multiple arrays of objects. It's a mess. I've been trying to use the split module in Logstash, but I'm not sure if this is the best way of doing it. I search for the field existence first, and if the filed exist, I'll split. Is there a better way of doing it? filter { if [protoPayload][request][disks] { split { field =\> "[protoPayload][request][disks]" } split { field =\> "[protoPayload][request][labels]" } s…

--thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 13, 2019, 9:57pm UTC](https://discuss.elastic.co/t/best-approach-to-split-arrays-of-objects/195567/2 "2019-09-13T21:57:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.