# Filter Array Values
**URL:** https://discuss.elastic.co/t/filter-array-values/164744
**Category:** Logstash
**Created:** [January 18, 2019, 7:29am UTC](https://discuss.elastic.co/t/filter-array-values/164744 "2019-01-18T07:29:46Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@ttSS](https://discuss.elastic.co/u/ttSS)
#### Post date: [January 18, 2019, 7:29am UTC](https://discuss.elastic.co/t/filter-array-values/164744/1 "2019-01-18T07:29:46Z")
I HAVE AN ARRAY OF MAC ADDRESS THAT I WANT TO FILTER IN LOGSTASH. I want to make it as a new document for each value. Can anybody help me ?
{"message":"["9c:20:7b:25:23:0d","88:d5:0c:cd:e6:09","c8:f2:30:c6:9a:e0","f4:f5:db:1d:07:73","30:f7:72:30:90:f7","c0:9f:05:ff:9e:33","60:fe:1e:dd:b6:0f","e0:aa:96:b1:66:b0","90:21:81:da:1f:f7","b0:70:2d:78:0b:8b","80:57:19:30:fb:75"
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [January 18, 2019, 1:06pm UTC](https://discuss.elastic.co/t/filter-array-values/164744/2 "2019-01-18T13:06:29Z")
Use a [split](https://www.elastic.co/guide/en/logstash/current/plugins-filters-split.html) filter.
---
### Author:  [@ttSS](https://discuss.elastic.co/u/ttSS)
#### Post date: [January 18, 2019, 1:21pm UTC](https://discuss.elastic.co/t/filter-array-values/164744/3 "2019-01-18T13:21:03Z")
i did but my elasticsearch is not getting any documents
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [January 18, 2019, 1:42pm UTC](https://discuss.elastic.co/t/filter-array-values/164744/4 "2019-01-18T13:42:53Z")
I suggest you replace your elasticsearch output with output { stdout { codec =\> rubydebug } } and see what logstash prints to stdout.
Nobody here can say what is wrong with your configuration if you don't show us your configuration.
---
### Author:  [@ttSS](https://discuss.elastic.co/u/ttSS)
#### Post date: [January 18, 2019, 1:50pm UTC](https://discuss.elastic.co/t/filter-array-values/164744/5 "2019-01-18T13:50:54Z")
input {
beats{
port =\> 5044
}
}
filter {
```
json {
source => "message"
}
split {
field => "message"
}
```
}
output {
elasticsearch {
hosts =\> ["localhost:9200"]
manage\_template =\> false
index =\> "%{[@metadata][beat]}"
}
}
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [January 18, 2019, 1:56pm UTC](https://discuss.elastic.co/t/filter-array-values/164744/6 "2019-01-18T13:56:53Z")
The input data as posted is not valid JSON. Please use \ in the toolbar above the editing pane to quote it so that formatting is preserved.
---
### Author:  [@ttSS](https://discuss.elastic.co/u/ttSS)
#### Post date: [January 18, 2019, 2:01pm UTC](https://discuss.elastic.co/t/filter-array-values/164744/7 "2019-01-18T14:01:03Z")
okay my bad , im so sorry im new to this thing.
---
### Author:  [@ttSS](https://discuss.elastic.co/u/ttSS)
#### Post date: [January 18, 2019, 2:10pm UTC](https://discuss.elastic.co/t/filter-array-values/164744/8 "2019-01-18T14:10:27Z")
i tried removing the json its still not working
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 15, 2019, 2:10pm UTC](https://discuss.elastic.co/t/filter-array-values/164744/9 "2019-02-15T14:10:28Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.