# Converting term array into individually name fields

**URL:** <https://discuss.elastic.co/t/converting-term-array-into-individually-name-fields/45397>\
**Category:** Logstash\
**Created:** [March 24, 2016, 8:32pm UTC](https://discuss.elastic.co/t/converting-term-array-into-individually-name-fields/45397 "2016-03-24T20:32:37Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Dani](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dani/32/8653_2.png) [@Dani](https://discuss.elastic.co/u/Dani)\
**Post date:** [March 24, 2016, 8:32pm UTC](https://discuss.elastic.co/t/converting-term-array-into-individually-name-fields/45397/1 "2016-03-24T20:32:37Z")

</div>

I'm trying to mutate my string into an array and then put each term into a separate field.

at the end of my grok, I have this pattern `(?<info>([^:])*)`

I've got the following mutate

```
split => ["info", "::"]
add_field => {"info_1" => "%{info[0]}"}
add_field => {"info_2" => "%{info[1]}"}
add_field => {"info_3" => "%{info[2]}"}
add_field => {"info_4" => "%{info[3]}"}
add_field => {"info_5" => "%{info[4]}"}
add_field => {"info_6" => "%{info[5]}"}
add_field => {"info_7" => "%{info[6]}"}
add_field => {"info_8" => "%{info[7]}"}

```

but the problem I have is that if the term at a set index does not exist, the data ends up being the pattern as a string

```
"info_5" => "%{info[4]}",
"info_6" => "%{info[5]}",
"info_7" => "%{info[6]}",
"info_8" => "%{info[7]}"

```

how do I get rid of these fields when there is no data?

---

<div class="post-metadata">

**Author:** ![Dani](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dani/32/8653_2.png) [@Dani](https://discuss.elastic.co/u/Dani)\
**Post date:** [March 24, 2016, 9:33pm UTC](https://discuss.elastic.co/t/converting-term-array-into-individually-name-fields/45397/2 "2016-03-24T21:33:49Z")

</div>

Figured it out...

```
filter {
  if [info_1] =~ /%\{info\[0\]\}/ {mutate {remove_field => ["info_1"]}}
  if [info_2] =~ /%\{info\[1\]\}/ {mutate {remove_field => ["info_2"]}}
  if [info_3] =~ /%\{info\[2\]\}/ {mutate {remove_field => ["info_3"]}}
  if [info_4] =~ /%\{info\[3\]\}/ {mutate {remove_field => ["info_4"]}}
  if [info_5] =~ /%\{info\[4\]\}/ {mutate {remove_field => ["info_5"]}}
  if [info_6] =~ /%\{info\[5\]\}/ {mutate {remove_field => ["info_6"]}}
  if [info_7] =~ /%\{info\[6\]\}/ {mutate {remove_field => ["info_7"]}}
  if [info_8] =~ /%\{info\[7\]\}/ {mutate {remove_field => ["info_8"]}}
}
```

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 25, 2016, 1:36pm UTC](https://discuss.elastic.co/t/converting-term-array-into-individually-name-fields/45397/3 "2016-03-25T13:36:09Z")

</div>

You can also use the prune filter to delete all fields with unexpanded field references. Alternatively, use a ruby filter to do the splitting and assign correct field names from the start.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:05am UTC](https://discuss.elastic.co/t/converting-term-array-into-individually-name-fields/45397/4 "2017-07-06T05:05:20Z")

</div>

Closed on July 6, 2017, 5:05am UTC