# How to divide a single field of a log in elasticsearch into multiple fields in a single event only using logstash filter plugin

**URL:** <https://discuss.elastic.co/t/how-to-divide-a-single-field-of-a-log-in-elasticsearch-into-multiple-fields-in-a-single-event-only-using-logstash-filter-plugin/318538>\
**Category:** Logstash\
**Created:** [November 9, 2022, 11:56am UTC](https://discuss.elastic.co/t/how-to-divide-a-single-field-of-a-log-in-elasticsearch-into-multiple-fields-in-a-single-event-only-using-logstash-filter-plugin/318538 "2022-11-09T11:56:39Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![khushi](https://avatars.discourse-cdn.com/v4/letter/k/5f8ce5/32.png) [@khushi](https://discuss.elastic.co/u/khushi)\
**Post date:** [November 9, 2022, 11:56am UTC](https://discuss.elastic.co/t/how-to-divide-a-single-field-of-a-log-in-elasticsearch-into-multiple-fields-in-a-single-event-only-using-logstash-filter-plugin/318538/1 "2022-11-09T11:56:39Z")

</div>

I am sending emails from a mail service to elasticsearch. Now I want to have multiple fields of a single field.

---

<div class="post-metadata">

**Author:** ![tatdat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tatdat/32/113160_2.png) [@tatdat](https://discuss.elastic.co/u/tatdat)\
**Post date:** [November 9, 2022, 3:19pm UTC](https://discuss.elastic.co/t/how-to-divide-a-single-field-of-a-log-in-elasticsearch-into-multiple-fields-in-a-single-event-only-using-logstash-filter-plugin/318538/2 "2022-11-09T15:19:39Z")

</div>

Could you give some example, input data and expected output. Thank!

---

<div class="post-metadata">

**Author:** ![khushi](https://avatars.discourse-cdn.com/v4/letter/k/5f8ce5/32.png) [@khushi](https://discuss.elastic.co/u/khushi)\
**Post date:** [November 10, 2022, 4:30am UTC](https://discuss.elastic.co/t/how-to-divide-a-single-field-of-a-log-in-elasticsearch-into-multiple-fields-in-a-single-event-only-using-logstash-filter-plugin/318538/3 "2022-11-10T04:30:48Z")

</div>

Hi, thanks for replying back.  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/1/614e91b2c69d6c55bb701b79b3fdde7c787ce9e7.png)

This image shows the data I am getting in the message field of my log in elasticsearch and I want to separate these headers in the sense that the header name should be the name of the field and the value of that header should the value of that particular field.

---

<div class="post-metadata">

**Author:** ![khushi](https://avatars.discourse-cdn.com/v4/letter/k/5f8ce5/32.png) [@khushi](https://discuss.elastic.co/u/khushi)\
**Post date:** [November 10, 2022, 4:32am UTC](https://discuss.elastic.co/t/how-to-divide-a-single-field-of-a-log-in-elasticsearch-into-multiple-fields-in-a-single-event-only-using-logstash-filter-plugin/318538/4 "2022-11-10T04:32:39Z")

</div>

![image](https://us1.discourse-cdn.com/elastic/original/3X/a/d/adb6c8e1e14a4b3d51d104d20674269e7efc8e13.png)  
Like you can see these fields I want to create such fields from that message field in the same event.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 8, 2022, 4:33am UTC](https://discuss.elastic.co/t/how-to-divide-a-single-field-of-a-log-in-elasticsearch-into-multiple-fields-in-a-single-event-only-using-logstash-filter-plugin/318538/5 "2022-12-08T04:33:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.