# CSV values matched to same field as array

**URL:** https://discuss.elastic.co/t/csv-values-matched-to-same-field-as-array/52721
**Category:** Logstash
**Created:** [June 14, 2016, 10:45am UTC](https://discuss.elastic.co/t/csv-values-matched-to-same-field-as-array/52721 "2016-06-14T10:45:47Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Mark\_Rodman](https://avatars.discourse-cdn.com/v4/letter/m/57b2e6/32.png) [@Mark\_Rodman](https://discuss.elastic.co/u/Mark_Rodman)
#### Post date: [June 14, 2016, 10:45am UTC](https://discuss.elastic.co/t/csv-values-matched-to-same-field-as-array/52721/1 "2016-06-14T10:45:47Z")

</div>

Hi community.  
I have an event stream which contains comma separated values which I wish to match into the the same field as an array without the comma.

An example might be.  
[value1, value2, val\_ue3, val ue4, value5, value6]

The number of values can vary as can the presence of whitespace.  
I'm looking for the most efficient way to add each value to the same field but as individual values in an array.  
As far as I can see the KV and CSV filters will create multiple fields which I'm not looking for.

Is there a trick I'm overlooking.

Thanks

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [June 15, 2016, 5:47am UTC](https://discuss.elastic.co/t/csv-values-matched-to-same-field-as-array/52721/2 "2016-06-15T05:47:35Z")

</div>

Have a look a the mutate filter's split option.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:52am UTC](https://discuss.elastic.co/t/csv-values-matched-to-same-field-as-array/52721/3 "2017-07-06T04:52:50Z")

</div>