# Getting separate values from single variable value in logstash

**URL:** <https://discuss.elastic.co/t/getting-separate-values-from-single-variable-value-in-logstash/295806>\
**Category:** Logstash\
**Created:** [January 31, 2022, 8:25am UTC](https://discuss.elastic.co/t/getting-separate-values-from-single-variable-value-in-logstash/295806 "2022-01-31T08:25:58Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![mangeshs](https://avatars.discourse-cdn.com/v4/letter/m/e36b37/32.png) [@mangeshs](https://discuss.elastic.co/u/mangeshs)\
**Post date:** [January 31, 2022, 8:25am UTC](https://discuss.elastic.co/t/getting-separate-values-from-single-variable-value-in-logstash/295806/1 "2022-01-31T08:25:58Z")

</div>

I have log line as follows

```auto
file_name,file_id,size,file_owner,folder_id,folder_name,path_ids,folder_owner,deleted,date_modified,date_uploaded,folder_paths
nash+animal models.docx,884054786846,20068,xyz@123.com,149986394846,PRATIBHA TEST,/148290247289/148291354564/149986382846/,xyz@123.com,No,2021-02-12,2021-11-12,/Folder Movement Test/For Sagar/ResearchHubFiles/

```

so there is field called path\_ids where it comes like as follows

```auto
/148290247289/148291354564/149986382846/

```

it can be multiple values separated by /  
I want multiple values from this field in elastic to aggregate using logstash filter

---

<div class="post-metadata">

**Author:** ![mangeshs](https://avatars.discourse-cdn.com/v4/letter/m/e36b37/32.png) [@mangeshs](https://discuss.elastic.co/u/mangeshs)\
**Post date:** [January 31, 2022, 10:15am UTC](https://discuss.elastic.co/t/getting-separate-values-from-single-variable-value-in-logstash/295806/2 "2022-01-31T10:15:54Z")

</div>

i have used ruby code but getting exception  
I am new to ruby is code right?

```auto
ruby {
			code => '
				ids = event["path_ids"].split("/")
				ids.each { |i| event["path_id#{ids[i]}"] = values[i]}
			'
		}

```

---

<div class="post-metadata">

**Author:** ![Tomo\_M](https://avatars.discourse-cdn.com/v4/letter/t/848f3c/32.png) [@Tomo\_M](https://discuss.elastic.co/u/Tomo_M)\
**Post date:** [January 31, 2022, 11:00am UTC](https://discuss.elastic.co/t/getting-separate-values-from-single-variable-value-in-logstash/295806/3 "2022-01-31T11:00:16Z")

</div>

Have you considerd using [Dissect filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-dissect.html) or [split of Mutate filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-split)?

---

<div class="post-metadata">

**Author:** ![mangeshs](https://avatars.discourse-cdn.com/v4/letter/m/e36b37/32.png) [@mangeshs](https://discuss.elastic.co/u/mangeshs)\
**Post date:** [January 31, 2022, 11:14am UTC](https://discuss.elastic.co/t/getting-separate-values-from-single-variable-value-in-logstash/295806/4 "2022-01-31T11:14:03Z")

</div>

i have used csv filter to get fields but now I have filed as path\_ids as /12345/54564/5466/  
so I want each numeric path id in different field  
and field value is dynamic

---

<div class="post-metadata">

**Author:** ![Tomo\_M](https://avatars.discourse-cdn.com/v4/letter/t/848f3c/32.png) [@Tomo\_M](https://discuss.elastic.co/u/Tomo_M)\
**Post date:** [January 31, 2022, 11:50am UTC](https://discuss.elastic.co/t/getting-separate-values-from-single-variable-value-in-logstash/295806/5 "2022-01-31T11:50:16Z")

</div>

if the depth of the path is not fixed, ruby filter could be better as you said.

I have not tried, but how about this?

```auto
ruby {
      code => '
          ids = event["path_ids"].split("/")
          ids.each_with_index{|id,i|
              event["path_id#{i}"] = id
          }
      '
  }

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 28, 2022, 11:50am UTC](https://discuss.elastic.co/t/getting-separate-values-from-single-variable-value-in-logstash/295806/6 "2022-02-28T11:50:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.