# How to split a message from rabbit?

**URL:** <https://discuss.elastic.co/t/how-to-split-a-message-from-rabbit/321067>\
**Category:** Logstash\
**Created:** [December 12, 2022, 7:53pm UTC](https://discuss.elastic.co/t/how-to-split-a-message-from-rabbit/321067 "2022-12-12T19:53:36Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![TheZadok42](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thezadok42/32/114583_2.png) [@TheZadok42](https://discuss.elastic.co/u/TheZadok42)\
**Post date:** [December 12, 2022, 7:53pm UTC](https://discuss.elastic.co/t/how-to-split-a-message-from-rabbit/321067/1 "2022-12-12T19:53:36Z")

</div>

Hi!  
I am trying to split this message:

```auto
{"test": "Test"}
{"test": "Test2"}

```

into two messages using this simple config:

```auto
input {                                                                    
    rabbitmq {                                                           
        host => "192.168.68.112"                                     
        queue => "TEST"                                                   
        user => "guest"
        password => "guest"
        durable => true                                                     
    }                 
}                                                          
filter {    
    split { }                                                             
}                      
output { stdout {} }

```

But I get this error:  
`Only String and Array types are splittable. field:message is of type = NilClass`

Is there a way to treat the input as raw string, split it to two messages using the line break and transform it back to json?

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [December 12, 2022, 8:01pm UTC](https://discuss.elastic.co/t/how-to-split-a-message-from-rabbit/321067/2 "2022-12-12T20:01:18Z")

</div>

What is your output?

You need to share how Logstash is receiving in what is the output you are getting to try to understand why the split is not working.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [December 12, 2022, 8:13pm UTC](https://discuss.elastic.co/t/how-to-split-a-message-from-rabbit/321067/3 "2022-12-12T20:13:53Z")

</div>

> [@TheZadok42](#):
>
> Only String and Array types are splittable. field:message is of type = NilClass

The default codec for a rabbitmq is json. Unless your JSON includes a message field it will not exist and you will get that error. What does an event look like if you use

```
output { stdout { codec => rubydebug } }

```

---

<div class="post-metadata">

**Author:** ![TheZadok42](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thezadok42/32/114583_2.png) [@TheZadok42](https://discuss.elastic.co/u/TheZadok42)\
**Post date:** [December 12, 2022, 8:35pm UTC](https://discuss.elastic.co/t/how-to-split-a-message-from-rabbit/321067/4 "2022-12-12T20:35:19Z")

</div>

> [@Badger](#):
>
> What does an event look like if you use

This is the output:

```auto
{
          "test" => "TEST",
      "@version" => "1",
    "@timestamp" => 2022-12-12T20:34:29.334542694Z,
         "event" => {
        "original" => "{\"test\": \"TEST\"}\r\n{\"test\": \"TEST2\"}"
    }
}

```

Thank you for the quick replay!

---

<div class="post-metadata">

**Author:** ![TheZadok42](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thezadok42/32/114583_2.png) [@TheZadok42](https://discuss.elastic.co/u/TheZadok42)\
**Post date:** [December 13, 2022, 5:31am UTC](https://discuss.elastic.co/t/how-to-split-a-message-from-rabbit/321067/5 "2022-12-13T05:31:56Z")

</div>

I found I should use `codec => "json_lines"` and it splits the message  
But now I found another problem, if the last line doesn't have a line break at the end, it ignores it

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 10, 2023, 5:31am UTC](https://discuss.elastic.co/t/how-to-split-a-message-from-rabbit/321067/6 "2023-01-10T05:31:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.