# \[Filebeat\] Range:%20990%0AX-SA-ID:%20778 to multiple fields

**URL:** https://discuss.elastic.co/t/filebeat-range-20990-0ax-sa-id-20778-to-multiple-fields/247346
**Category:** Beats
**Tags:** filebeat
**Created:** [September 3, 2020, 8:49am UTC](https://discuss.elastic.co/t/filebeat-range-20990-0ax-sa-id-20778-to-multiple-fields/247346 "2020-09-03T08:49:33Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Kuo\_Hugo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kuo_hugo/32/1641_2.png) [@Kuo\_Hugo](https://discuss.elastic.co/u/Kuo_Hugo)
#### Post date: [September 3, 2020, 8:49am UTC](https://discuss.elastic.co/t/filebeat-range-20990-0ax-sa-id-20778-to-multiple-fields/247346/1 "2020-09-03T08:49:33Z")

</div>

Hi,

May I know if there's a way to split the string into multiple fields?

Range:%20990%0AX-SA-ID:%20778

This is encoded. The decoded string is `Range: 990\nX-SA-ID: 778`  
My goal is to split it into multiple field and the field name should be the key of each value. Such as.

{  
"Range": 990,  
"X-SA-ID":778  
}

while urldecode processor, I got Range: 990\nX-SA-ID: 778.

Appreciate

---

<div class="post-metadata">

### Author: ![ChrsMark](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chrsmark/32/55858_2.png) [@ChrsMark](https://discuss.elastic.co/u/ChrsMark)
#### Post date: [September 3, 2020, 10:17am UTC](https://discuss.elastic.co/t/filebeat-range-20990-0ax-sa-id-20778-to-multiple-fields/247346/2 "2020-09-03T10:17:04Z")

</div>

Hi!

I would suggest using `script` processor [https://www.elastic.co/guide/en/beats/filebeat/master/processor-script.html](https://www.elastic.co/guide/en/beats/filebeat/master/processor-script.html) and "manually" split the string.

C.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 1, 2020, 12:17pm UTC](https://discuss.elastic.co/t/filebeat-range-20990-0ax-sa-id-20778-to-multiple-fields/247346/3 "2020-10-01T12:17:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
