# How to split single field values in to multipleterms in logstash

**URL:** <https://discuss.elastic.co/t/how-to-split-single-field-values-in-to-multipleterms-in-logstash/211666>\
**Category:** Logstash\
**Created:** [December 12, 2019, 2:25pm UTC](https://discuss.elastic.co/t/how-to-split-single-field-values-in-to-multipleterms-in-logstash/211666 "2019-12-12T14:25:37Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![saravana\_hariharan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/saravana_hariharan/32/57379_2.png) [@saravana\_hariharan](https://discuss.elastic.co/u/saravana_hariharan)\
**Post date:** [December 12, 2019, 2:25pm UTC](https://discuss.elastic.co/t/how-to-split-single-field-values-in-to-multipleterms-in-logstash/211666/1 "2019-12-12T14:25:37Z")

</div>

(Fieldvalue =\> createdby,createdtime,updatedby,updatedtime)

i need a individual field for createdtime in my kibana option

thanks  
saravanan.R

---

<div class="post-metadata">

**Author:** ![rameshkr1994](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rameshkr1994/32/59029_2.png) [@rameshkr1994](https://discuss.elastic.co/u/rameshkr1994)\
**Post date:** [December 12, 2019, 2:32pm UTC](https://discuss.elastic.co/t/how-to-split-single-field-values-in-to-multipleterms-in-logstash/211666/2 "2019-12-12T14:32:28Z")

</div>

Hi @saravana_hariharan.

where you are using this use case?

> please explain more.

Thanks  
HadoopHelp

---

<div class="post-metadata">

**Author:** ![saravana\_hariharan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/saravana_hariharan/32/57379_2.png) [@saravana\_hariharan](https://discuss.elastic.co/u/saravana_hariharan)\
**Post date:** [December 12, 2019, 2:54pm UTC](https://discuss.elastic.co/t/how-to-split-single-field-values-in-to-multipleterms-in-logstash/211666/3 "2019-12-12T14:54:51Z")

</div>

im using it in logfile fields time,sessionid,requestid, fieldvalue columns and my question is inside of fieldvalue column these terms are placed. how to split the createdtime value to individual field (createdby,createdtime ,updatedby,updatedtime,name,etc.,)  
grok{  
match =\>["message","%{NUMBER:TIME} \t %{WORD:SESSIONID} \t %{GREEDYDATA:FieldValue}"]  
}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 9, 2020, 3:01pm UTC](https://discuss.elastic.co/t/how-to-split-single-field-values-in-to-multipleterms-in-logstash/211666/4 "2020-01-09T15:01:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.