How to split field value into an array?

Hello,
I would like to split a field value into an array of values. Field type is keyword and I would like to separate these values, so we can filter each value separately (e.g. "app1").

example:
applname: app1, app2, app3

expected result:
applname: ["app1","app2","app3"]

I tried to use split filter:

 mutate {
    split => { "applname" => ", " }
 }

But the result was:

"applname": ["app1,app2,app3"]

Is there a better way how to achieve the expected result?
Thanks!

Solved.

The original field was:
applname: app1,app2,app3

So using split filter the value of the field was saved as an array.

mutate {
    split => { "applname" => "," }
 }
applname: ["app1","app2","app3"]`

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.