# How to split column which has multpiple values

**URL:** <https://discuss.elastic.co/t/how-to-split-column-which-has-multpiple-values/211744>\
**Category:** Logstash\
**Created:** [December 13, 2019, 4:46am UTC](https://discuss.elastic.co/t/how-to-split-column-which-has-multpiple-values/211744 "2019-12-13T04:46:45Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![saravana\_hariharan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/saravana_hariharan/32/57379_2.png) [@saravana\_hariharan](https://discuss.elastic.co/u/saravana_hariharan)\
**Post date:** [December 13, 2019, 4:46am UTC](https://discuss.elastic.co/t/how-to-split-column-which-has-multpiple-values/211744/1 "2019-12-13T04:46:45Z")

</div>

im using it in logfile fields time,sessionid,requestid, fieldvalue columns and my question is inside of fieldvalue column these terms are placed. how to split the createdtime value to individual field (createdby,createdtime ,updatedby,updatedtime,name,etc.,)  
grok{  
match =\>["message","%{NUMBER:TIME} \t %{WORD:SESSIONID} \t %{GREEDYDATA:FieldValue}"]  
}

thanks  
saravanan.R

---

<div class="post-metadata">

**Author:** ![ITIC](https://avatars.discourse-cdn.com/v4/letter/i/90ced4/32.png) [@ITIC](https://discuss.elastic.co/u/ITIC)\
**Post date:** [December 13, 2019, 8:10am UTC](https://discuss.elastic.co/t/how-to-split-column-which-has-multpiple-values/211744/2 "2019-12-13T08:10:16Z")

</div>

Hi

You could use a second `grok{}` filter, placed after the first, where your `FieldValue` already exists, and extract your "createdby", etc.:

```auto
grok {
  match => ["FieldValue", ".... your stuff goes here..."]
}

```

Hope this helps.

---

<div class="post-metadata">

**Author:** ![saravana\_hariharan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/saravana_hariharan/32/57379_2.png) [@saravana\_hariharan](https://discuss.elastic.co/u/saravana_hariharan)\
**Post date:** [December 13, 2019, 8:27am UTC](https://discuss.elastic.co/t/how-to-split-column-which-has-multpiple-values/211744/3 "2019-12-13T08:27:41Z")

</div>

thankyou bro i will try it now

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 10, 2020, 8:27am UTC](https://discuss.elastic.co/t/how-to-split-column-which-has-multpiple-values/211744/4 "2020-01-10T08:27:45Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.