# How to split array without a target?

**URL:** https://discuss.elastic.co/t/how-to-split-array-without-a-target/1590
**Category:** Logstash
**Created:** [May 30, 2015, 6:47pm UTC](https://discuss.elastic.co/t/how-to-split-array-without-a-target/1590 "2015-05-30T18:47:18Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![aiden](https://avatars.discourse-cdn.com/v4/letter/a/d2c977/32.png) [@aiden](https://discuss.elastic.co/u/aiden)
#### Post date: [May 30, 2015, 6:47pm UTC](https://discuss.elastic.co/t/how-to-split-array-without-a-target/1590/1 "2015-05-30T18:47:18Z")

</div>

Hi,

I'm trying to split a JSON array into multiple events. Here's a sample input:

```
{"results" : [{"id": "a1", "name": "hello"}, {"id": "a2", "name": "logstash"}]}

```

Here's my filter and output config:

```
filter {
  split {
    field => "results"
  }
}
stdout { 
  codec => "rubydebug"
}

```

This produces close to what I'm looking for:

```
{                                              
       "results" => {                          
          "id" => "a1",                        
        "name" => "hello"                      
    },                                         
      "@version" => "1",                       
    "@timestamp" => "2015-05-30T18:33:21.527Z",
          "host" => "laptop",                                      
}                                              
{                                              
       "results" => {                          
          "id" => "a2",                        
        "name" => "logstash"                   
    },                                         
      "@version" => "1",                       
    "@timestamp" => "2015-05-30T18:33:21.527Z",
          "host" => "laptop",                                   
}                                              

```

The problem is the nested "results" part. "results" being the default value for the target parameter.  
Is there a way to use the split filter without producing the nested JSON, and get something like this:

```
{                                                                     
          "id" => "a1",                        
        "name" => "hello"                      
      "@version" => "1",                       
    "@timestamp" => "2015-05-30T18:33:21.527Z",
          "host" => "laptop",                                      
}                                              
{                                              
          "id" => "a2",                        
        "name" => "logstash"                   
      "@version" => "1",                       
    "@timestamp" => "2015-05-30T18:33:21.527Z",
          "host" => "laptop",                                   
}

```

EDITED:  
The purpose is to feed this to the ElasticSearch output with each event being a document with document\_id =\> "id". Any good solutions are welcomed!

---

<div class="post-metadata">

### Author: ![rafaltrojniak](https://avatars.discourse-cdn.com/v4/letter/r/ecc23a/32.png) [@rafaltrojniak](https://discuss.elastic.co/u/rafaltrojniak)
#### Post date: [June 4, 2015, 10:41pm UTC](https://discuss.elastic.co/t/how-to-split-array-without-a-target/1590/2 "2015-06-04T22:41:50Z")

</div>

Hello @aiden,  
That's an interesting problem.

To have each 'result' a separate document, you have to split that single logstash event to two logstash events.  
After that each of the two event has to be processed separately. One to use first result, second to use second result.

To duplicate an event, You can use 'clone' filter. For managing part of the evnets, I had tried to use 'mutate' filter, but it has some problems when moving elements of an array, so I filled a bug report, and used ruby for that.

Here is example POC for that :

- My rules  
[https://github.com/rafaltrojniak/logstash\_rules/blob/split/rules/split.conf](https://github.com/rafaltrojniak/logstash_rules/blob/split/rules/split.conf)
- Some documentation and events  
[https://github.com/rafaltrojniak/logstash\_rules/blob/split/doc.md](https://github.com/rafaltrojniak/logstash_rules/blob/split/doc.md)

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:38am UTC](https://discuss.elastic.co/t/how-to-split-array-without-a-target/1590/3 "2017-07-06T05:38:28Z")

</div>