# How to split array or string with "Ingest Node Pipeline"

**URL:** <https://discuss.elastic.co/t/how-to-split-array-or-string-with-ingest-node-pipeline/277052>\
**Category:** Elasticsearch\
**Created:** [June 25, 2021, 11:32am UTC](https://discuss.elastic.co/t/how-to-split-array-or-string-with-ingest-node-pipeline/277052 "2021-06-25T11:32:50Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![HaKuNa](https://avatars.discourse-cdn.com/v4/letter/h/c77e96/32.png) [@HaKuNa](https://discuss.elastic.co/u/HaKuNa)\
**Post date:** [June 25, 2021, 11:32am UTC](https://discuss.elastic.co/t/how-to-split-array-or-string-with-ingest-node-pipeline/277052/1 "2021-06-25T11:32:50Z")

</div>

Hi  
I'm new to ECE and have a filebeat pipeline which sends data to ECE.  
This is the format of the message field which I have in ECE (separator would be -\> \t):

```auto
2021-06-25T13:08:39.559+0200 INFO 12409 com.l7tech.traffic: 2021-06-25T11:08:39.554Z\tno_endpoint\tmonitoring\tno_operation\tno_consumer_timestamp\tCOM-556\t0\ttrue\t0\tno_consumer_certificate\t13\tnon-routing\t\t10.183.135.249\tundefined\tundefined\tundefined\tundefined\tundefined\tundefined\tundefined\t/monitoring\tundefined

```

The aim is to separate the values by \t and add them to a new field.

I'm able to get the first value (date) with the SPLIT processor

```auto
regex *([\s]+)(.*)

```

-\> the regex which should work is ([^\s]+) but I had to add (.\*) at the end ... strange. I have not yet understood how the regex processor is working in the SPLIT processor.

But then I'm now struggeling with the other 22 parts.  
I tried to first move to a sting value with:  
SET processor, value={{field\_message}}, which leads to a string:

```auto
{0=2021-06-25T13:08:39.559+0200 INFO 12409 com.l7tech.traffic: 2021-06-25T11:08:39.554Z, 1=no_endpoint, 2=monitoring, 3=no_operation, 4=no_consumer_timestamp, 5=COM-556, 6=0, 7=true, 8=0, 9=no_consumer_certificate, 10=13, 11=non-routing, 12=, 13=10.183.135.249, 14=undefined, 15=undefined, 16=undefined, 17=undefined, 18=undefined, 19=undefined, 20=undefined, 21=/monitoring, 22=undefined}

```

Then I tried to separate the new string value with separate SPLIT processors for each value.  
The separator regex is working on [https://regex101.com/](https://regex101.com/) with the string value above.

```auto
0=(.*?),
1=(.*?),
2=(.*?),
...
22=(.*?),

```

But this is not working in the Ingest Node Pipeline.

Is there a better way to store all the individual values from the input to new fields ?

Would be great if someone can put me in the right direction.

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [June 29, 2021, 9:25am UTC](https://discuss.elastic.co/t/how-to-split-array-or-string-with-ingest-node-pipeline/277052/2 "2021-06-29T09:25:35Z")

</div>

the split processor sounds right. Can you share a **fully reproducible** example using the [Simulate Ingest Pipeline API](https://www.elastic.co/guide/en/elasticsearch/reference/7.13/simulate-pipeline-api.html) so that others can try to build the same?

Thank you!

---

<div class="post-metadata">

**Author:** ![HaKuNa](https://avatars.discourse-cdn.com/v4/letter/h/c77e96/32.png) [@HaKuNa](https://discuss.elastic.co/u/HaKuNa)\
**Post date:** [June 29, 2021, 12:23pm UTC](https://discuss.elastic.co/t/how-to-split-array-or-string-with-ingest-node-pipeline/277052/3 "2021-06-29T12:23:33Z")

</div>

Thanks for the response.  
In the meantime I solved my issue by using a "Script" processor

```auto
int tempStart = ctx.tempFormatted.indexOf("19=",0);
int tempEnd = ctx.tempFormatted.indexOf("20=",0);
ctx.providerMessageId = ctx.tempFormatted.substring(tempStart+3,tempEnd-2);

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 27, 2021, 12:23pm UTC](https://discuss.elastic.co/t/how-to-split-array-or-string-with-ingest-node-pipeline/277052/4 "2021-07-27T12:23:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.