# Cloning events from items in an array?

**URL:** <https://discuss.elastic.co/t/cloning-events-from-items-in-an-array/51256>\
**Category:** Logstash\
**Created:** [May 29, 2016, 9:56pm UTC](https://discuss.elastic.co/t/cloning-events-from-items-in-an-array/51256 "2016-05-29T21:56:54Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![mightyschwartz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mightyschwartz/32/10007_2.png) [@mightyschwartz](https://discuss.elastic.co/u/mightyschwartz)\
**Post date:** [May 29, 2016, 9:56pm UTC](https://discuss.elastic.co/t/cloning-events-from-items-in-an-array/51256/1 "2016-05-29T21:56:54Z")

</div>

I've seen this done previously with JSON docs. However, I have data coming in as comma separated values like so:

> Created jobgroup: XYZ containing jobid(s): ABC,DEF,GHI,JKL,MNO

While I want the jobgroup, I want the jobids to be separate log events nested beneath these items later.

I've used split to create an array from the values, but I'd like to be able to break each jobid into an event. Even if that is iterating through and cloning while marking the root event at the jobgroup level invalid in the output section.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [May 29, 2016, 9:58pm UTC](https://discuss.elastic.co/t/cloning-events-from-items-in-an-array/51256/2 "2016-05-29T21:58:29Z")

</div>

Tried [https://www.elastic.co/guide/en/logstash/current/plugins-filters-clone.html](https://www.elastic.co/guide/en/logstash/current/plugins-filters-clone.html)?

---

<div class="post-metadata">

**Author:** ![mightyschwartz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mightyschwartz/32/10007_2.png) [@mightyschwartz](https://discuss.elastic.co/u/mightyschwartz)\
**Post date:** [May 29, 2016, 10:13pm UTC](https://discuss.elastic.co/t/cloning-events-from-items-in-an-array/51256/3 "2016-05-29T22:13:15Z")

</div>

I have and I end up with to events containing the following... seems to clone the array.

> ```
> "jobgroup" => "09039daa-f79f-4fe5-aac9-72abb2ceda48",
> "job_ids" => [
> [0] "3ba2b061-ae7c-4b97-ab99-c5bfd4fcae49",
> [1] "9ebe83f8-7fc4-49cd-90e3-603aa4a5d4d2"
> ]
> 
> ```

> ```
> "jobgroup" => "09039daa-f79f-4fe5-aac9-72abb2ceda48",
> "job_ids" => [
> [0] "3ba2b061-ae7c-4b97-ab99-c5bfd4fcae49",
> [1] "9ebe83f8-7fc4-49cd-90e3-603aa4a5d4d2"
> ]
> 
> ```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:55am UTC](https://discuss.elastic.co/t/cloning-events-from-items-in-an-array/51256/4 "2017-07-06T04:55:38Z")

</div>

Closed on July 6, 2017, 4:55am UTC