# Extract value from a multivalued field

**URL:** <https://discuss.elastic.co/t/extract-value-from-a-multivalued-field/271359>\
**Category:** Logstash\
**Created:** [April 27, 2021, 10:32am UTC](https://discuss.elastic.co/t/extract-value-from-a-multivalued-field/271359 "2021-04-27T10:32:08Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![chriselk](https://avatars.discourse-cdn.com/v4/letter/c/ecae2f/32.png) [@chriselk](https://discuss.elastic.co/u/chriselk)\
**Post date:** [April 27, 2021, 10:32am UTC](https://discuss.elastic.co/t/extract-value-from-a-multivalued-field/271359/1 "2021-04-27T10:32:08Z")

</div>

Hi,  
trying a simple stuff with logstash but could not get the expected result...

I have a multivalued Field like:

```auto
"PUB_WEIGHT": [
      "3",
      "4",
      "6",
      "8"
    ]

```

and in want to convert to

Field\_1: 3  
Field\_2: 4  
Field\_3: 6  
Field\_4: 8

I try

```auto
add_field => { 'Filed_1' => "%{PUB_WEIGHT}[1]"}

or

match => { "PUB_WEIGHT" => "%{GREEDYDATA:Field_1},.*%{GREEDYDATA:Field_2},.*%{GREEDYDATA:Field_3},.*%{GREEDYDATA:Field_4}" }

```

It's fixed always 4 entries, I try some grok expression but could found, not sure if I need to count the carriage return

---

<div class="post-metadata">

**Author:** ![Cad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cad/32/86661_2.png) [@Cad](https://discuss.elastic.co/u/Cad)\
**Post date:** [April 27, 2021, 10:45am UTC](https://discuss.elastic.co/t/extract-value-from-a-multivalued-field/271359/2 "2021-04-27T10:45:08Z")

</div>

Hi,

You can use the Split plugin [Documentation](https://www.elastic.co/guide/en/logstash/current/plugins-filters-split.html).

Cad

---

<div class="post-metadata">

**Author:** ![chriselk](https://avatars.discourse-cdn.com/v4/letter/c/ecae2f/32.png) [@chriselk](https://discuss.elastic.co/u/chriselk)\
**Post date:** [April 27, 2021, 11:33am UTC](https://discuss.elastic.co/t/extract-value-from-a-multivalued-field/271359/3 "2021-04-27T11:33:51Z")

</div>

Great, Thank you for you quick help it's works now

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 27, 2021, 2:16pm UTC](https://discuss.elastic.co/t/extract-value-from-a-multivalued-field/271359/4 "2021-04-27T14:16:22Z")

</div>

> [@chriselk](#):
>
> `add_field => { 'Filed_1' => "%{PUB_WEIGHT}[1]"}`

That should be `add_field => { 'Field_1' => "%{[PUB_WEIGHT][0]}"}`

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 25, 2021, 2:17pm UTC](https://discuss.elastic.co/t/extract-value-from-a-multivalued-field/271359/5 "2021-05-25T14:17:18Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.