# Create new records from old one

**URL:** <https://discuss.elastic.co/t/create-new-records-from-old-one/291989>\
**Category:** Logstash\
**Created:** [December 15, 2021, 2:08pm UTC](https://discuss.elastic.co/t/create-new-records-from-old-one/291989 "2021-12-15T14:08:41Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![ddoroshenko](https://avatars.discourse-cdn.com/v4/letter/d/b9e5f3/32.png) [@ddoroshenko](https://discuss.elastic.co/u/ddoroshenko)\
**Post date:** [December 15, 2021, 2:08pm UTC](https://discuss.elastic.co/t/create-new-records-from-old-one/291989/1 "2021-12-15T14:08:41Z")

</div>

Hello!

I have JSON at input

```auto
{
  "data:{
    "id":"123"
  },
  "message":[
    "event1",
    "event2",
    "event3"
  ],
  "source":"abc"
}

```

Is it possible to make three different events based on `"event1"`, `"event2"` and `"event3"` like

```auto
{
  "data:{
    "id":"123"
  },
  "event1",
  "source":"abc"
}

```

and so on ?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [December 15, 2021, 2:22pm UTC](https://discuss.elastic.co/t/create-new-records-from-old-one/291989/2 "2021-12-15T14:22:11Z")

</div>

You can use a split filter to split the array into three different events. I am not sure what you mean by

"event1",

A hash entry needs a key and a value.

---

<div class="post-metadata">

**Author:** ![ddoroshenko](https://avatars.discourse-cdn.com/v4/letter/d/b9e5f3/32.png) [@ddoroshenko](https://discuss.elastic.co/u/ddoroshenko)\
**Post date:** [December 15, 2021, 2:56pm UTC](https://discuss.elastic.co/t/create-new-records-from-old-one/291989/3 "2021-12-15T14:56:04Z")

</div>

@Badger

the input JSON is

```auto
{
  "data:{
    "id":"123"
  },
  "message":[
    "2021-12-15T19:50:00-0700 [INFO]: message1",
    "2021-12-15T19:51:00-0700 [INFO]: message2"
  ],
  "source":"abc"
}

```

So I want to get two events

```auto
{
  "data:{
    "id":"123"
  },
  "2021-12-15T19:50:00-0700 [INFO]: message1",
  "source":"abc"
}

```

and

```auto
{
  "data:{
    "id":"123"
  },
  "2021-12-15T19:51:00-0700 [INFO]: message2",
  "source":"abc"
}

```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [December 15, 2021, 3:07pm UTC](https://discuss.elastic.co/t/create-new-records-from-old-one/291989/4 "2021-12-15T15:07:50Z")

</div>

Neither of those would be valid JSON.

---

<div class="post-metadata">

**Author:** ![ddoroshenko](https://avatars.discourse-cdn.com/v4/letter/d/b9e5f3/32.png) [@ddoroshenko](https://discuss.elastic.co/u/ddoroshenko)\
**Post date:** [December 15, 2021, 3:14pm UTC](https://discuss.elastic.co/t/create-new-records-from-old-one/291989/5 "2021-12-15T15:14:31Z")

</div>

@Badger when I parse it with json filter I get

```auto
"source" => "abc",
      "@version" => "1",
      "sequence" => 0,
          "host" => "localhost.localdomain",
       "message" => [
        [0] "2021-12-15T19:50:00-0700 [INFO]: message1",
        [1] "2021-12-15T19:51:00-0700 [INFO]: message2"
    ],
    "@timestamp" => 2021-12-15T14:48:06.259Z,
          "data" => {
        "id" => "123"
    }

```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [December 15, 2021, 3:26pm UTC](https://discuss.elastic.co/t/create-new-records-from-old-one/291989/6 "2021-12-15T15:26:33Z")

</div>

And if you use a split filter you can change that to two events that look like

```
      "host" => "localhost.localdomain",
   "message" => "2021-12-15T19:50:00-0700 [INFO]: message1",
"@timestamp" => 2021-12-15T14:48:06.259Z,
      "data" => {
    "id" => "123"
}

```

But you cannot convert them to be

```
      "host" => "localhost.localdomain",
   "2021-12-15T19:50:00-0700 [INFO]: message1",
"@timestamp" => 2021-12-15T14:48:06.259Z,
      "data" => {
    "id" => "123"
}

```

which is what you are asking for.

---

<div class="post-metadata">

**Author:** ![ddoroshenko](https://avatars.discourse-cdn.com/v4/letter/d/b9e5f3/32.png) [@ddoroshenko](https://discuss.elastic.co/u/ddoroshenko)\
**Post date:** [December 15, 2021, 3:32pm UTC](https://discuss.elastic.co/t/create-new-records-from-old-one/291989/7 "2021-12-15T15:32:45Z")

</div>

@Badger this one is what I want

```auto
"host" => "localhost.localdomain",
   "message" => "2021-12-15T19:50:00-0700 [INFO]: message1",
"@timestamp" => 2021-12-15T14:48:06.259Z,
      "data" => {
    "id" => "123"
}

```

but when I use split filter after json filter

```auto
mutate {
    split => { "[message]" => "," }
  }

```

I get the error `mutate - Can't split something that isn't a string`

---

<div class="post-metadata">

**Author:** ![ddoroshenko](https://avatars.discourse-cdn.com/v4/letter/d/b9e5f3/32.png) [@ddoroshenko](https://discuss.elastic.co/u/ddoroshenko)\
**Post date:** [December 15, 2021, 3:42pm UTC](https://discuss.elastic.co/t/create-new-records-from-old-one/291989/8 "2021-12-15T15:42:25Z")

</div>

I've used wrong filter 🤦‍♂️  
It should be

```auto
split {
    field => "message"
  }

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 12, 2022, 3:43pm UTC](https://discuss.elastic.co/t/create-new-records-from-old-one/291989/9 "2022-01-12T15:43:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.