# How to split a single line message, into parts
**URL:** https://discuss.elastic.co/t/how-to-split-a-single-line-message-into-parts/306982
**Category:** Logstash
**Created:** [June 13, 2022, 3:50am UTC](https://discuss.elastic.co/t/how-to-split-a-single-line-message-into-parts/306982 "2022-06-13T03:50:12Z")
**Posts on this page:** 10
**Page:** 1
### Author:  [@Zerra\_Triani](https://discuss.elastic.co/u/Zerra_Triani)
#### Post date: [June 13, 2022, 3:50am UTC](https://discuss.elastic.co/t/how-to-split-a-single-line-message-into-parts/306982/1 "2022-06-13T03:50:12Z")
Hi, I've created a logstash to filter a log and output a single message. Then I want to split that message into several fields. What filter plugin should I use? I try to use split filter and it doesn't work
> **The example messege**
> 0200F338400988E08000000000000500000416603494608702093001100000004000000002241005250000000042290710052502246011011100110345106450005000481422907ATM35802BSMCUST451ABCFHUSJOKKLMNA360107102901902000003451
The Field i want:
> field 1: 0200
> field 2: F3384
> etc..
Logstash
```auto
input {
beats {
port => 5044
}
}
filter {
ruby {
# old nw code => " event.set('msgfilter', event.get('message').scan(/\s{7}[a-zA-Z0-9]+(?=\r\n|\s+\r\nReceived)/) ) "
#code => " event.set('msgfilter', event.get('message').scan(/\s{7}[a-zA-Z0-9\s]+(?=\r\n)/) ) "
code => " event.set('msgfilter', event.get('message').scan(/\s{7}[a-zA-Z0-9\s]+(?=\n)/) ) "
id => "ruby-counter"
}
# merge array of strings
mutate { join => { "msgfilter" => "" } }
# remove spaces
mutate { gsub => ["msgfilter", " " , ""] }
mutate {
remove_field => ["message", "tags", "path"]
}
#split {
#add_field => { "foo_%{somefield}" => "Hello world, from %{host}" }
#}
}
output {
elasticsearch {
hosts => ["localhost:9200"]
}
}
```
Thank you
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 13, 2022, 4:05am UTC](https://discuss.elastic.co/t/how-to-split-a-single-line-message-into-parts/306982/2 "2022-06-13T04:05:40Z")
> [@Zerra\_Triani](#):
>
> The Field i want:
>
> > field 1: 0200
> > field 2: F3384
> > etc..
"etc." does not tell us enough. Do you want a string broken into 9 character chunks which are then split into two fields of 4 and 5 characters? If so, ruby and .scan look like a good way to go. But the nature of .scan is that you get arrays of arrays, so you may need to rearrange them. See [here](https://discuss.elastic.co/t/processing-large-amoung-of-data-with-logstash/242020/5) and [here](https://discuss.elastic.co/t/stop-proccesing-events-lines-after-first-grok-match/214696/10).
---
### Author:  [@Zerra\_Triani](https://discuss.elastic.co/u/Zerra_Triani)
#### Post date: [June 13, 2022, 8:42am UTC](https://discuss.elastic.co/t/how-to-split-a-single-line-message-into-parts/306982/4 "2022-06-13T08:42:21Z")
I've followed the way you suggested, and it still doesn't work. Which part did I go wrong?
```auto
filter {
ruby {
# old nw code => " event.set('msgfilter', event.get('message').scan(/\s{7}[a-zA-Z0-9]+(?=\r\n|\s+\r\nReceived)/) ) "
code => " event.set('msgfilter', event.get('message').scan(/\s{7}[a-zA-Z0-9\s]+(?=\r\n)/) )"
id => "ruby-counter"
}
# merge array of strings
mutate { join => { "msgfilter" => "" } }
# remove spaces
mutate { gsub => ["msgfilter", " " , ""] }
mutate {
remove_field => ["message", "tags", "path"]
}
ruby {
code => '
s = event.get("msgfilter")
if s
event.set("matches", s.scan(([a-zA-Z0-9\s]{4}/);([a-zA-Z0-9\s]{5}/))
end
'
}
}
```
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 13, 2022, 4:45pm UTC](https://discuss.elastic.co/t/how-to-split-a-single-line-message-into-parts/306982/5 "2022-06-13T16:45:19Z")
You have not explained what results you are getting or what you do not like about them.
---
### Author:  [@Zerra\_Triani](https://discuss.elastic.co/u/Zerra_Triani)
#### Post date: [June 14, 2022, 3:20am UTC](https://discuss.elastic.co/t/how-to-split-a-single-line-message-into-parts/306982/6 "2022-06-14T03:20:40Z")
> [@Badger](#):
>
> You have not explained what results you are getting or what you do not like about them.
It' doesn't work when i running the logstash
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 14, 2022, 3:26am UTC](https://discuss.elastic.co/t/how-to-split-a-single-line-message-into-parts/306982/7 "2022-06-14T03:26:19Z")
Please do not post pictures of text, just post the text, they are impossible to search, some people will be unable to view them, and we cannot copy and paste information to try and reproduce and diagnose the problem.
.scan take a regexp, so you need // around the regexp
```
s.scan(/([a-zA-Z0-9]{5})/)
```
Not sure why you have added () to create a capture group when that pattern only matches one thing.
---
### Author:  [@Zerra\_Triani](https://discuss.elastic.co/u/Zerra_Triani)
#### Post date: [June 14, 2022, 4:08am UTC](https://discuss.elastic.co/t/how-to-split-a-single-line-message-into-parts/306982/8 "2022-06-14T04:08:09Z")
I just tried it for one value, after it works I will add several other values.
I've tried it and it works in powershell but it doesn't show up in kibana, I've refreshed the index pattern but it's still the same.
---
### Author:  [@Zerra\_Triani](https://discuss.elastic.co/u/Zerra_Triani)
#### Post date: [June 17, 2022, 3:31pm UTC](https://discuss.elastic.co/t/how-to-split-a-single-line-message-into-parts/306982/9 "2022-06-17T15:31:47Z")
Hi, it's working now. But how do I retrieve with several different number of digits like the example in the photo? And how do I give each field a name. Sorry I'm new to elastic. Thank you
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 17, 2022, 5:36pm UTC](https://discuss.elastic.co/t/how-to-split-a-single-line-message-into-parts/306982/10 "2022-06-17T17:36:32Z")
Please do not post pictures of text. They are not searchable, some people cannot even see them, and nobody can copy and paste them to try to reproduce and diagnose the issue.
That said, you might want something like [this](https://discuss.elastic.co/t/grok-pattern-data-not-giving-all-matches-from-the-line/140468/2), or [this](https://discuss.elastic.co/t/how-to-split-the-one-field-into-multiple-fields-using-kv-plugins/172067/4), or [this](https://discuss.elastic.co/t/iterating-over-the-same-grok-filter/295089/3). Or maybe not, you have not explained what you are trying to do.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 15, 2022, 5:37pm UTC](https://discuss.elastic.co/t/how-to-split-a-single-line-message-into-parts/306982/11 "2022-07-15T17:37:17Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.