# How to Split the one field into multiple fields using kv plugins

**URL:** <https://discuss.elastic.co/t/how-to-split-the-one-field-into-multiple-fields-using-kv-plugins/172067>\
**Category:** Logstash\
**Created:** [March 13, 2019, 6:41am UTC](https://discuss.elastic.co/t/how-to-split-the-one-field-into-multiple-fields-using-kv-plugins/172067 "2019-03-13T06:41:04Z")\
**Posts on this page:** 1\
**Showing post:** 4

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 13, 2019, 12:53pm UTC](https://discuss.elastic.co/t/how-to-split-the-one-field-into-multiple-fields-using-kv-plugins/172067/4 "2019-03-13T12:53:00Z")

</div>

If an example of log\_message is

```auto
(Institution Id->77) (data Id->127) QUERY-> insert into tablename1(col1,col2) values(val1,val2) ERROR->Table 'tablename1' doesn't exist

```

Then you could parse that (and the other 2) using this

```
    grok { match => { "log_message" => "^%{DATA:prefix}QUERY\-> %{DATA:query} ERROR(: |\->)%{DATA:error}$" } }
    if [prefix] {
        ruby {
            code => '
                m = event.get("prefix").scan(/\(([^-]+)\->([^\)]+)\)/)
                m.each.each { |k, v|
                    event.set(k, v)
                }
            '
        }
    }

```

In the ruby filter the scan function matches a regexp against the "prefix" field. The regexp looks for (key-\>value) patterns and returns an array of them. Each match is on entry in the array, and that entry itself is an array, the first entry of which is the key, and the second is the value.

---

_[View the full topic](https://discuss.elastic.co/t/how-to-split-the-one-field-into-multiple-fields-using-kv-plugins/172067)._