# How to split a field which would be no value set

**URL:** <https://discuss.elastic.co/t/how-to-split-a-field-which-would-be-no-value-set/83155>\
**Category:** Logstash\
**Created:** [April 21, 2017, 7:02am UTC](https://discuss.elastic.co/t/how-to-split-a-field-which-would-be-no-value-set/83155 "2017-04-21T07:02:09Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![kibanaLuee](https://avatars.discourse-cdn.com/v4/letter/k/e95f7d/32.png) [@kibanaLuee](https://discuss.elastic.co/u/kibanaLuee)\
**Post date:** [April 21, 2017, 7:02am UTC](https://discuss.elastic.co/t/how-to-split-a-field-which-would-be-no-value-set/83155/1 "2017-04-21T07:02:09Z")

</div>

I have a json log, format is:

{  
"data": [  
{  
"Name": "a1 name",  
"Age": "a1 age",  
"School": [  
{  
"s1": "s1-value1",  
"s2": "s2-value1"  
}  
],  
"Work": [  
{  
"w1": "w1-value1",  
"w2": "w2-value1"  
}  
],  
{  
"Name": "a2 name",  
"Age": "a2 age",  
"School": [],  
"Work": []  
},  
{  
"Name": "a3 name",  
"Age": "a3 age",  
"School": [],  
"Work": []  
}  
]  
}

I want to split field "data", and also if field "School" and "Work" set values  
in, need split "School" and "Work" fields to get data.School.s1,  
data.School.s2, data.Work,w1, data.Work.w2 values. Now my issue is, when  
i set config file as following:

filter {  
if ([data]) {  
split {  
field =\> "data"  
}  
}  
if ([data][School]) {  
split {  
field =\> "data[School]"  
}  
}  
if ([data][Work]) {  
split {  
field =\> "data[Work]"  
}  
}  
}

The out put is just the first data array values get in logstash, other no values set for Work[] or School[] records are not enter logstash.

How can I get all datas in logstash, for both values in or no values in Work[] or School[].

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 19, 2017, 7:06am UTC](https://discuss.elastic.co/t/how-to-split-a-field-which-would-be-no-value-set/83155/2 "2017-05-19T07:06:42Z")

</div>

Closed on May 19, 2017, 7:06am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.