# How can I split fields
**URL:** https://discuss.elastic.co/t/how-can-i-split-fields/98682
**Category:** Logstash
**Created:** [August 29, 2017, 12:18pm UTC](https://discuss.elastic.co/t/how-can-i-split-fields/98682 "2017-08-29T12:18:53Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@mikygee](https://discuss.elastic.co/u/mikygee)
#### Post date: [August 29, 2017, 12:18pm UTC](https://discuss.elastic.co/t/how-can-i-split-fields/98682/1 "2017-08-29T12:18:53Z")
Hello,
I have a field that looks like that
lists: list1 list2
The number of lists is not defined, here it's 2 but it can be 3 or 4
I'd like to create new fields with new values
lists1 =\> list1
lists2 =\> list2
Do you know how can I do that ?
The syslog message looks like this
IP.43.144.37: disconnected after 11 seconds. lists: blockliste spamliste
And I have a grok rule that retrieves "blockliste spamliste"
I would like to make statistics regarding spam lists: the spam list that bloc the most spam mails.
Regards
---
### Author:  [@Mojster](https://discuss.elastic.co/u/Mojster)
#### Post date: [August 29, 2017, 12:26pm UTC](https://discuss.elastic.co/t/how-can-i-split-fields/98682/2 "2017-08-29T12:26:52Z")
First of all I would suggest to `split` by " " using `mutate`.
For the second step, here's a topic over iteration:
[Iteration in Logstash](https://discuss.elastic.co/t/iteration-in-logstash/26123/2)
---
### Author:  [@mikygee](https://discuss.elastic.co/u/mikygee)
#### Post date: [August 29, 2017, 3:52pm UTC](https://discuss.elastic.co/t/how-can-i-split-fields/98682/3 "2017-08-29T15:52:14Z")
Thank you for your answer, I will make some tests.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 26, 2017, 4:04pm UTC](https://discuss.elastic.co/t/how-can-i-split-fields/98682/4 "2017-09-26T16:04:11Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.