# How to split the field in Kibana?

**URL:** <https://discuss.elastic.co/t/how-to-split-the-field-in-kibana/279048>\
**Category:** Kibana\
**Created:** [July 19, 2021, 10:57am UTC](https://discuss.elastic.co/t/how-to-split-the-field-in-kibana/279048 "2021-07-19T10:57:36Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![testisnullus](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/testisnullus/32/91816_2.png) [@testisnullus](https://discuss.elastic.co/u/testisnullus)\
**Post date:** [July 19, 2021, 10:57am UTC](https://discuss.elastic.co/t/how-to-split-the-field-in-kibana/279048/1 "2021-07-19T10:57:36Z")

</div>

Hi all!  
I have the message field in Kibana like this:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/5/5/551d479dfa77da6eece805b4af5ae0ead910ae50.png)

I want to convert this field in something like:

```auto
message.app: rbac
message.args: []
message.commandTag: null
message.fields.time: 330709
etc

```

Kibana version: 7.7.1  
Flebeat version: 7.6.2

Thanks for your help!  
Danil

---

<div class="post-metadata">

**Author:** ![Felix\_Roessel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/felix_roessel/32/41623_2.png) [@Felix\_Roessel](https://discuss.elastic.co/u/Felix_Roessel)\
**Post date:** [July 19, 2021, 3:30pm UTC](https://discuss.elastic.co/t/how-to-split-the-field-in-kibana/279048/2 "2021-07-19T15:30:46Z")

</div>

The best way is to send your message on ingest time through the json processor of your ingest node pipeline.

> **[JSON processor | Elasticsearch Guide \[7.13\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/json-processor.html)**

---

<div class="post-metadata">

**Author:** ![testisnullus](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/testisnullus/32/91816_2.png) [@testisnullus](https://discuss.elastic.co/u/testisnullus)\
**Post date:** [July 20, 2021, 8:22am UTC](https://discuss.elastic.co/t/how-to-split-the-field-in-kibana/279048/3 "2021-07-20T08:22:57Z")

</div>

Thanks a lot for your help!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 17, 2021, 8:23am UTC](https://discuss.elastic.co/t/how-to-split-the-field-in-kibana/279048/4 "2021-08-17T08:23:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.