I have the following index. colors,value "blue,red", 10 "red", 20 "green", 5 "blue,red", 15 "blue,green", 5 I want to aggregate value by color like so. blue = 10, 15, 5 red = 10, 20, 15 green = 5, 5 The problem is that individual colors appear as comma-delimited elements of a single text field. …

No, this applies to Logstash. Elasticsearch uses Ingest Pipelines, there is no equivalent to the Logstash split filter. You cannot split an array into multiple documents using Ingest Pipelines, if you want to do that you need to parse your data in Logstash and then send it to Elasticsearch.

Discuss the Elastic Stack

Explode a document into multiple documents by delimited text field

Elastic Stack Elasticsearch

wpm (W.P. McNeill) March 21, 2025, 10:46pm 3

Is this the answer?

Topic		Replies	Views
Consider comma separated values in a field as separate values while aggregating Elasticsearch	3	822	November 29, 2023
Partition and Index by Text Field Contents Elasticsearch	3	16	March 19, 2025
Document cloning and splitting in Ingest APIs Elasticsearch	4	846	June 20, 2017
Split/explode strings Logstash ingest-pipeline	3	643	April 13, 2021
Split a document into several documents Elasticsearch	1	631	March 26, 2018

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Explode a document into multiple documents by delimited text field

Related topics