# How to select or return specific part from Split ingest pipeline

**URL:** <https://discuss.elastic.co/t/how-to-select-or-return-specific-part-from-split-ingest-pipeline/280146>\
**Category:** Elasticsearch\
**Created:** [August 1, 2021, 11:27am UTC](https://discuss.elastic.co/t/how-to-select-or-return-specific-part-from-split-ingest-pipeline/280146 "2021-08-01T11:27:04Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mojahid\_Ahmad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mojahid_ahmad/32/78061_2.png) [@Mojahid\_Ahmad](https://discuss.elastic.co/u/Mojahid_Ahmad)\
**Post date:** [August 1, 2021, 11:27am UTC](https://discuss.elastic.co/t/how-to-select-or-return-specific-part-from-split-ingest-pipeline/280146/1 "2021-08-01T11:27:04Z")

</div>

I have created one split ingest pipeline, it is working fine. But I want to return only the first part of the text.

```auto
GET _ingest/pipeline/_simulate 
{
  "pipeline":{
    "processors":[
      {
      "split":{
        "field":"message",
        "separator": ";"
      }
    }
    ]  
  },
  "docs":[
    {
      "_source":{
        "message":"SAS Grant Suspension Failure;6825;serial_no.=EB184812696;supplAlarmInfo:SUSPENDED_GRANT;additionalFaultId=682"
    }
  }
    
    ]
}

```

This is the output

```auto
{
  "docs" : [
    {
      "doc" : {
        "_index" : "_index",
        "_type" : "_doc",
        "_id" : "_id",
        "_source" : {
          "message" : [
            "SAS Grant Suspension Failure",
            "6825",
            "serial_no.=EB184812696",
            "supplAlarmInfo:SUSPENDED_GRANT",
            "additionalFaultId=682"
          ]
        },
        "_ingest" : {
          "timestamp" : "2021-08-01T11:01:55.937955952Z"
        }
      }
    }
  ]
}

```

I want to return "SAS Grant Suspension Failure" only and store it in a new field,  
Please help me with this. Thank you

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [August 1, 2021, 12:07pm UTC](https://discuss.elastic.co/t/how-to-select-or-return-specific-part-from-split-ingest-pipeline/280146/2 "2021-08-01T12:07:32Z")

</div>

You can probably use a dissect or grok processor instead.

---

<div class="post-metadata">

**Author:** ![Mojahid\_Ahmad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mojahid_ahmad/32/78061_2.png) [@Mojahid\_Ahmad](https://discuss.elastic.co/u/Mojahid_Ahmad)\
**Post date:** [August 2, 2021, 6:12am UTC](https://discuss.elastic.co/t/how-to-select-or-return-specific-part-from-split-ingest-pipeline/280146/3 "2021-08-02T06:12:36Z")

</div>

What would be the pattern to extract _ **SAS Grant Suspension Failure** _ only?  
Struggling with this.

---

<div class="post-metadata">

**Author:** ![Mojahid\_Ahmad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mojahid_ahmad/32/78061_2.png) [@Mojahid\_Ahmad](https://discuss.elastic.co/u/Mojahid_Ahmad)\
**Post date:** [August 2, 2021, 7:05am UTC](https://discuss.elastic.co/t/how-to-select-or-return-specific-part-from-split-ingest-pipeline/280146/4 "2021-08-02T07:05:19Z")

</div>

I figured out the pattern

```auto
{
"patterns":["%{INTERESTED_PART:new_field}"],
        "pattern_definitions" : {
          "INTERESTED_PART" : "SAS Grant Suspension Failure"
        }
      }

```

I tested the ingest pipeline it's working fine. . But want to know how does it will automatically process this ingest and create a new field in the index?

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [August 2, 2021, 8:09am UTC](https://discuss.elastic.co/t/how-to-select-or-return-specific-part-from-split-ingest-pipeline/280146/5 "2021-08-02T08:09:29Z")

</div>

What about:

```auto
GET _ingest/pipeline/_simulate
{
  "pipeline": {
    "processors": [
      {
        "dissect": {
          "field": "message",
          "pattern": "%{label};%{?text}"
        }
      },
      {
        "remove": {
          "field": "message"
        }
      }
    ]
  },
  "docs": [
    {
      "_source": {
        "message": "SAS Grant Suspension Failure;6825;serial_no.=EB184812696;supplAlarmInfo:SUSPENDED_GRANT;additionalFaultId=682"
      }
    }
  ]
}

```

This gives:

```auto
{
  "docs" : [
    {
      "doc" : {
        "_index" : "_index",
        "_type" : "_doc",
        "_id" : "_id",
        "_source" : {
          "label" : "SAS Grant Suspension Failure"
        },
        "_ingest" : {
          "timestamp" : "2021-08-02T08:09:03.046277011Z"
        }
      }
    }
  ]
}

```

---

<div class="post-metadata">

**Author:** ![Mojahid\_Ahmad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mojahid_ahmad/32/78061_2.png) [@Mojahid\_Ahmad](https://discuss.elastic.co/u/Mojahid_Ahmad)\
**Post date:** [August 2, 2021, 8:20am UTC](https://discuss.elastic.co/t/how-to-select-or-return-specific-part-from-split-ingest-pipeline/280146/6 "2021-08-02T08:20:25Z")

</div>

Thanks, this also works. The only thing I am struggling with is, how to attach this ingest to the index? Do I need to mention pipeline somewhere in the configuration file? What's the process?

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [August 2, 2021, 8:58am UTC](https://discuss.elastic.co/t/how-to-select-or-return-specific-part-from-split-ingest-pipeline/280146/7 "2021-08-02T08:58:13Z")

</div>

Once you have created the pipeline, you can use it from the index API:

```auto
POST index/_doc?pipeline=your-pipeline-name
{
  "message": "SAS Grant Suspension Failure;6825;serial_no.=EB184812696;supplAlarmInfo:SUSPENDED_GRANT;additionalFaultId=682"
}

```

Or you can define a default pipeline. See `index.default_pipeline` in [Index modules | Elasticsearch Guide [7.13] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/index-modules.html).

---

<div class="post-metadata">

**Author:** ![Mojahid\_Ahmad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mojahid_ahmad/32/78061_2.png) [@Mojahid\_Ahmad](https://discuss.elastic.co/u/Mojahid_Ahmad)\
**Post date:** [August 11, 2021, 1:52pm UTC](https://discuss.elastic.co/t/how-to-select-or-return-specific-part-from-split-ingest-pipeline/280146/8 "2021-08-11T13:52:19Z")

</div>

Thank you @dadoonet

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 8, 2021, 1:53pm UTC](https://discuss.elastic.co/t/how-to-select-or-return-specific-part-from-split-ingest-pipeline/280146/9 "2021-09-08T13:53:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.