# How to split a single line message, into parts

**URL:** <https://discuss.elastic.co/t/how-to-split-a-single-line-message-into-parts/306982>\
**Category:** Logstash\
**Created:** [June 13, 2022, 3:50am UTC](https://discuss.elastic.co/t/how-to-split-a-single-line-message-into-parts/306982 "2022-06-13T03:50:12Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 13, 2022, 4:05am UTC](https://discuss.elastic.co/t/how-to-split-a-single-line-message-into-parts/306982/2 "2022-06-13T04:05:40Z")

</div>

> [@Zerra\_Triani](#):
>
> The Field i want:
> 
> > field 1: 0200  
> > field 2: F3384  
> > etc..

"etc." does not tell us enough. Do you want a string broken into 9 character chunks which are then split into two fields of 4 and 5 characters? If so, ruby and .scan look like a good way to go. But the nature of .scan is that you get arrays of arrays, so you may need to rearrange them. See [here](https://discuss.elastic.co/t/processing-large-amoung-of-data-with-logstash/242020/5) and [here](https://discuss.elastic.co/t/stop-proccesing-events-lines-after-first-grok-match/214696/10).

---

_[View the full topic](https://discuss.elastic.co/t/how-to-split-a-single-line-message-into-parts/306982)._