# How to split into multiple events dynamically for a given json? Tried from various question in forums

**URL:** <https://discuss.elastic.co/t/how-to-split-into-multiple-events-dynamically-for-a-given-json-tried-from-various-question-in-forums/167745>\
**Category:** Logstash\
**Created:** [February 10, 2019, 9:54am UTC](https://discuss.elastic.co/t/how-to-split-into-multiple-events-dynamically-for-a-given-json-tried-from-various-question-in-forums/167745 "2019-02-10T09:54:04Z")\
**Posts on this page:** 1\
**Showing post:** 10

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [February 10, 2019, 5:45pm UTC](https://discuss.elastic.co/t/how-to-split-into-multiple-events-dynamically-for-a-given-json-tried-from-various-question-in-forums/167745/10 "2019-02-10T17:45:30Z")

</div>

The following may work. In a file called splitData.rb put

```auto
def register(params)
    @field = params['field']
    @target = params['target']
end

def filter(event)
    data = event.get(@field)
    event.remove(@field)
    a = []
    data.each { |x|
        e = event.clone
        e.set(@target, x)
        a << e
    }
    a
end

```

Then call it using

```
json {
    source => "message"
    remove_field => ["message"]
}
ruby {
    path => '/home/user/splitData.rb'
    script_params => { field => "data" target => "data" }
}

```

The critical point is to remove the data field before call event.clone.

It occurred to me that the split filter ought to be able to do this optimization (remove source before cloning if it is going to be overwritten). Looking at the code it appears that [this line](https://github.com/logstash-plugins/logstash-filter-split/blob/5670ae483d019918a30ddf61fcbc55843fc7e0a0/lib/logstash/filters/split.rb#L70) may be trying to do this. However I don't know what target refers to (not @target, which is never nil) so I am not sure what it does

---

_[View the full topic](https://discuss.elastic.co/t/how-to-split-into-multiple-events-dynamically-for-a-given-json-tried-from-various-question-in-forums/167745)._