# Fetching substring from a string in kibana

**URL:** <https://discuss.elastic.co/t/fetching-substring-from-a-string-in-kibana/338203>\
**Category:** Kibana\
**Created:** [July 12, 2023, 10:33am UTC](https://discuss.elastic.co/t/fetching-substring-from-a-string-in-kibana/338203 "2023-07-12T10:33:34Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![Neelam\_Zanvar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/neelam_zanvar/32/103116_2.png) [@Neelam\_Zanvar](https://discuss.elastic.co/u/Neelam_Zanvar)\
**Post date:** [July 12, 2023, 10:33am UTC](https://discuss.elastic.co/t/fetching-substring-from-a-string-in-kibana/338203/1 "2023-07-12T10:33:34Z")

</div>

Hi, I have a field called url in elasticsearch document.  
The sample value for the field is /3dpassport/login  
I want to extract only the first string before / that is 3dpassport and store it in a field.  
I am okay with doing this using logstash mutate as well. i tried it, but it is not working

```auto
        copy => {
          "url" => "service_name"
        }
        split => {
          "service_name" => "/"
        }

```

with the above config both url and service\_name have the value /3dpassport/login  
I want to retain the original value of url and save 3dpassport in service\_name.  
If i change the config as follows

```auto
        copy => {
          "url" => "service_name"
        }
        split => {
          "url" => "/"
        }

``
then both url and service_name are having the split values. How can i achieve this?

```

---

<div class="post-metadata">

**Author:** ![tsullivan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tsullivan/32/31077_2.png) [@tsullivan](https://discuss.elastic.co/u/tsullivan)\
**Post date:** [July 12, 2023, 8:38pm UTC](https://discuss.elastic.co/t/fetching-substring-from-a-string-in-kibana/338203/2 "2023-07-12T20:38:07Z")

</div>

Hi, I think you want to try the "mutate" filter to split the URL field and store part of the splitted result into a new field. Here's an example that might help:

```auto
filter {
  mutate {
    split => ["url", "/"]
    add_field => { "service_name" => "%{[url][1]}" }
  }
}

```

I haven't tried this and this could contain errors. If you need more help, you might want to ask this question in the Logstash area of this forum: [https://discuss.elastic.co/c/elastic-stack/logstash/14](https://discuss.elastic.co/c/elastic-stack/logstash/14)

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [July 12, 2023, 9:33pm UTC](https://discuss.elastic.co/t/fetching-substring-from-a-string-in-kibana/338203/3 "2023-07-12T21:33:50Z")

</div>

It's common way to use as tsullivan suggested and will work.

Also, it's not forbidden to use parsers:

```auto
   dissect { 
     mapping => { "url" => "/%{urldiss}/%{}" }
   }
 
   grok { match => { "message" => ["^\/%{DATA:urlgrok}\/"] } }

```

---

<div class="post-metadata">

**Author:** ![Neelam\_Zanvar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/neelam_zanvar/32/103116_2.png) [@Neelam\_Zanvar](https://discuss.elastic.co/u/Neelam_Zanvar)\
**Post date:** [July 13, 2023, 7:42am UTC](https://discuss.elastic.co/t/fetching-substring-from-a-string-in-kibana/338203/4 "2023-07-13T07:42:48Z")

</div>

but in this case i will loose the original value of url. i want url to have the entire string. and the service name to be the  
%{[url][1]}

---

<div class="post-metadata">

**Author:** ![tsullivan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tsullivan/32/31077_2.png) [@tsullivan](https://discuss.elastic.co/u/tsullivan)\
**Post date:** [July 13, 2023, 6:02pm UTC](https://discuss.elastic.co/t/fetching-substring-from-a-string-in-kibana/338203/5 "2023-07-13T18:02:34Z")

</div>

If you are losing the original value, double-check your config. The substring you need should be added as a new field and leave your `url` field alone.

---

<div class="post-metadata">

**Author:** ![Neelam\_Zanvar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/neelam_zanvar/32/103116_2.png) [@Neelam\_Zanvar](https://discuss.elastic.co/u/Neelam_Zanvar)\
**Post date:** [July 19, 2023, 9:31am UTC](https://discuss.elastic.co/t/fetching-substring-from-a-string-in-kibana/338203/6 "2023-07-19T09:31:42Z")

</div>

```auto
copy => {
          "url" => "service_name"
        }
        split => {
          "service_name" => "/"
        }
        add_field => { "service" => "%{service_name[1]}" }

```

Here is the code. In this case  
url =\> /3dpassport/healthcheck  
service\_name=\> /3dpassport/healthcheck

there is no separate field created for service  
After making changes in pipeline i have deleted and recreated data views

---

<div class="post-metadata">

**Author:** ![Neelam\_Zanvar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/neelam_zanvar/32/103116_2.png) [@Neelam\_Zanvar](https://discuss.elastic.co/u/Neelam_Zanvar)\
**Post date:** [July 26, 2023, 6:25am UTC](https://discuss.elastic.co/t/fetching-substring-from-a-string-in-kibana/338203/7 "2023-07-26T06:25:00Z")

</div>

```auto
copy => {
          "url" => "service_name"
        }
        split => {
          "service_name" => "/"
        }
        add_field => { "service" => "%{service_name[1]}" }

```

Here is the code. In this case  
url =\> /3dpassport/healthcheck  
service\_name=\> /3dpassport/healthcheck

there is no separate field created for service  
After making changes in pipeline i have deleted and recreated data views

---

<div class="post-metadata">

**Author:** ![Neelam\_Zanvar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/neelam_zanvar/32/103116_2.png) [@Neelam\_Zanvar](https://discuss.elastic.co/u/Neelam_Zanvar)\
**Post date:** [July 27, 2023, 6:17am UTC](https://discuss.elastic.co/t/fetching-substring-from-a-string-in-kibana/338203/8 "2023-07-27T06:17:43Z")

</div>

if i put it in this format  
"%{[url][1]}"  
i am getting service name as  
service\_name =\> %{[url][1]}

and if i put "%{url[1]}" there is no service field generated. looks like some syntax problem accessing the array

---

<div class="post-metadata">

**Author:** ![tsullivan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tsullivan/32/31077_2.png) [@tsullivan](https://discuss.elastic.co/u/tsullivan)\
**Post date:** [July 31, 2023, 8:58pm UTC](https://discuss.elastic.co/t/fetching-substring-from-a-string-in-kibana/338203/9 "2023-07-31T20:58:31Z")

</div>

Hi Neelam, I'm sorry we didn't give an answer that helped you [here](https://discuss.elastic.co/t/fetching-substring-from-a-string-in-kibana/338203/2) and [here](https://discuss.elastic.co/t/fetching-substring-from-a-string-in-kibana/338203/3). You may want to try the [Logstash](https://discuss.elastic.co/c/elastic-stack/logstash/14) area of this forum for help with this.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 28, 2023, 8:59pm UTC](https://discuss.elastic.co/t/fetching-substring-from-a-string-in-kibana/338203/10 "2023-08-28T20:59:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.