# How to split field value into an array?

**URL:** https://discuss.elastic.co/t/how-to-split-field-value-into-an-array/245197
**Category:** Logstash
**Created:** [August 17, 2020, 8:33am UTC](https://discuss.elastic.co/t/how-to-split-field-value-into-an-array/245197 "2020-08-17T08:33:59Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Robo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/robo/32/38295_2.png) [@Robo](https://discuss.elastic.co/u/Robo)
#### Post date: [August 17, 2020, 8:34am UTC](https://discuss.elastic.co/t/how-to-split-field-value-into-an-array/245197/1 "2020-08-17T08:34:00Z")

</div>

Hello,  
I would like to split a field value into an array of values. Field type is keyword and I would like to separate these values, so we can filter each value separately (e.g. "app1").

example:  
applname: app1, app2, app3

expected result:  
applname: ["app1","app2","app3"]

I tried to use split filter:

```auto
 mutate {
    split => { "applname" => ", " }
 }

```

But the result was:

```auto
"applname": ["app1,app2,app3"]

```

Is there a better way how to achieve the expected result?  
Thanks!

---

<div class="post-metadata">

### Author: ![Robo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/robo/32/38295_2.png) [@Robo](https://discuss.elastic.co/u/Robo)
#### Post date: [August 17, 2020, 9:57am UTC](https://discuss.elastic.co/t/how-to-split-field-value-into-an-array/245197/2 "2020-08-17T09:57:15Z")

</div>

Solved.

The original field was:  
applname: app1,app2,app3

So using split filter the value of the field was saved as an array.

```auto
mutate {
    split => { "applname" => "," }
 }

```

```auto
applname: ["app1","app2","app3"]`

```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 14, 2020, 9:57am UTC](https://discuss.elastic.co/t/how-to-split-field-value-into-an-array/245197/3 "2020-09-14T09:57:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
