# Creating multiple fields from single field

**URL:** <https://discuss.elastic.co/t/creating-multiple-fields-from-single-field/67382>\
**Category:** Logstash\
**Created:** [November 28, 2016, 5:12pm UTC](https://discuss.elastic.co/t/creating-multiple-fields-from-single-field/67382 "2016-11-28T17:12:16Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![marinoc](https://avatars.discourse-cdn.com/v4/letter/m/87869e/32.png) [@marinoc](https://discuss.elastic.co/u/marinoc)\
**Post date:** [November 28, 2016, 5:12pm UTC](https://discuss.elastic.co/t/creating-multiple-fields-from-single-field/67382/1 "2016-11-28T17:12:16Z")

</div>

I'm using the csv input filter to ingest csv files into Elasticsearch. One of the fields, "CustomFields" contains key/value pairs like this:

CustomFields  
"""Author=Jules J. Toner, S.J."";Binding=Paper;""Publication Date=2011"";""Pages=337 pages"";ISBN=9780912422428"

Instead of ingesting CustomFields as a single string field, I'd like to create a new top level field for each key/value pair in this field like this

I used mutate/split filter to get this field to look like this:

```
     "ProductCustomFields" => [
    [0] "\"Author=Jules J. Toner, S.J.\"",
    [1] "Binding=Paper",
    [2] "\"Publication Date=2011\"",
    [3] "\"Pages=337 pages\"",
    [4] "ISBN=9780912422428"
],

```

However, what I really want is this:

```
     "ProductCustomFields" => [
    [0] "\"Author=Jules J. Toner, S.J.\"",
    [1] "Binding=Paper",
    [2] "\"Publication Date=2011\"",
    [3] "\"Pages=337 pages\"",
    [4] "ISBN=9780912422428"
],
     "Author" => "Jules J. Toner, S.J.",
     "Binding" => "Paper",
     "Publication Date" => "2011",

```

...

Any suggestions?

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [November 28, 2016, 5:22pm UTC](https://discuss.elastic.co/t/creating-multiple-fields-from-single-field/67382/2 "2016-11-28T17:22:16Z")

</div>

Have you tried applying the [kv filter](https://www.elastic.co/guide/en/logstash/5.0/plugins-filters-kv.html), possibly after cleaning up the data using a mutate filter?

---

<div class="post-metadata">

**Author:** ![marinoc](https://avatars.discourse-cdn.com/v4/letter/m/87869e/32.png) [@marinoc](https://discuss.elastic.co/u/marinoc)\
**Post date:** [November 29, 2016, 12:59am UTC](https://discuss.elastic.co/t/creating-multiple-fields-from-single-field/67382/3 "2016-11-29T00:59:08Z")

</div>

Thanks, Christian. I was looking at the ruby filter as well (found an example online). But it looks like your suggestion is much easier to implement.

Chris

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 27, 2016, 12:59am UTC](https://discuss.elastic.co/t/creating-multiple-fields-from-single-field/67382/4 "2016-12-27T00:59:08Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.