How to split field value into an array?

I would like to split a field value into an array of values. Field type is keyword and I would like to separate these values, so we can filter each value separately (e.g. "app1").

applname: app1, app2, app3

expected result:
applname: ["app1","app2","app3"]

I tried to use split filter:

 mutate {
    split => { "applname" => ", " }

But the result was:

"applname": ["app1,app2,app3"]

Is there a better way how to achieve the expected result?


The original field was:
applname: app1,app2,app3

So using split filter the value of the field was saved as an array.

mutate {
    split => { "applname" => "," }
applname: ["app1","app2","app3"]`

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.