# Best method of delimiter splitting

**URL:** <https://discuss.elastic.co/t/best-method-of-delimiter-splitting/209095>\
**Category:** Logstash\
**Created:** [November 22, 2019, 4:38pm UTC](https://discuss.elastic.co/t/best-method-of-delimiter-splitting/209095 "2019-11-22T16:38:11Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![gborg](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gborg/32/58934_2.png) [@gborg](https://discuss.elastic.co/u/gborg)\
**Post date:** [November 22, 2019, 4:38pm UTC](https://discuss.elastic.co/t/best-method-of-delimiter-splitting/209095/1 "2019-11-22T16:38:11Z")

</div>

Hello

I have had a few fields with deliniter seperated strings that I have expanded into their own fields  
With grok

Is that the best method ?

Explanation:

You have a field: ":foo:bar:goat"

I want the first field, I can do a grok filter ":%{WORD:fieldIwant}"

But is there a better method ?

In a standard POSIX shell I would just do "awk -F ":" '{print $1}"

Just seems weird to me to use something I think of more like regex to simply delimeter data

So yeah, is the grok approach the right one or would it be better to use something like split and then addressing the field by position ?

I am processing over 10K messages per second so my primary concern is efficiency

---

<div class="post-metadata">

**Author:** ![elasticforme](https://avatars.discourse-cdn.com/v4/letter/e/f05b48/32.png) [@elasticforme](https://discuss.elastic.co/u/elasticforme)\
**Post date:** [November 22, 2019, 4:41pm UTC](https://discuss.elastic.co/t/best-method-of-delimiter-splitting/209095/2 "2019-11-22T16:41:17Z")

</div>

this is what I have done

For first field, and then remove everthing.  
I do not know which is better grok or split.

```
mutate {
        split => ["s_it", ":"]
        add_field => { "size" => "%{[s_it][0]}" }
}
mutate { remove_field => ["[s_it]" }
```

---

<div class="post-metadata">

**Author:** ![gborg](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gborg/32/58934_2.png) [@gborg](https://discuss.elastic.co/u/gborg)\
**Post date:** [November 22, 2019, 6:30pm UTC](https://discuss.elastic.co/t/best-method-of-delimiter-splitting/209095/3 "2019-11-22T18:30:34Z")

</div>

Cool  
i haven't seen this method before 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 20, 2019, 6:30pm UTC](https://discuss.elastic.co/t/best-method-of-delimiter-splitting/209095/4 "2019-12-20T18:30:52Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.