# How to split the records on data with only value and without key

**URL:** <https://discuss.elastic.co/t/how-to-split-the-records-on-data-with-only-value-and-without-key/114134>\
**Category:** Logstash\
**Created:** [January 4, 2018, 5:33pm UTC](https://discuss.elastic.co/t/how-to-split-the-records-on-data-with-only-value-and-without-key/114134 "2018-01-04T17:33:01Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![rkhapre](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rkhapre/32/48333_2.png) [@rkhapre](https://discuss.elastic.co/u/rkhapre)\
**Post date:** [January 4, 2018, 5:33pm UTC](https://discuss.elastic.co/t/how-to-split-the-records-on-data-with-only-value-and-without-key/114134/1 "2018-01-04T17:33:01Z")

</div>

Hi All

Currently, i am getting data in the below format

> ```
> "rows": [
> [
> "New Visitor",
> "(not set)",
> "(direct)",
> "(none)",
> "desktop",
> "123456",
> "Direct",
> "2",
> "2",
> "0",
> "4",
> "156.0",
> "0",
> "0.0",
> "0"
> ],
> [
> "New Visitor",
> "(not set)",
> "(direct)",
> "(none)",
> "desktop",
> "25677001",
> "Direct",
> "1",
> "0",
> "0",
> "3",
> "76.0",
> "0",
> "0.0",
> "0"
> ],
> 
> ```

How can i split the key and define the event for each value. Upfront i know the event name for each value.  
Currently when i index,i see only 1 record.  
I was planning to use split event, since it does not have any key,how we can split such data?

---

<div class="post-metadata">

**Author:** ![rkhapre](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rkhapre/32/48333_2.png) [@rkhapre](https://discuss.elastic.co/u/rkhapre)\
**Post date:** [January 5, 2018, 6:03am UTC](https://discuss.elastic.co/t/how-to-split-the-records-on-data-with-only-value-and-without-key/114134/2 "2018-01-05T06:03:48Z")

</div>

Hi, I used split at rows, now i am able to get multiple records. But the problem how i assign them to individual events/columns

`split {field => "[rows]"}`

For example :  
"Visitor Type" Column will hold value "New Visitor"  
"Page Type" Column will hold value "(not set)"  
"Instance" column will hold value "(direct)" and so on....

How can i assign column to each comma seperated values?

> ```
> "rows": [
> "New Visitor",
> "(not set)",
> "(direct)",
> "(none)",
> "desktop",
> "201801030000",
> "Direct",
> "2",
> "2",
> "0",
> "4",
> "156.0",
> "0",
> "0.0",
> "0"
> ],
> 
> ```

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [January 5, 2018, 9:57am UTC](https://discuss.elastic.co/t/how-to-split-the-records-on-data-with-only-value-and-without-key/114134/3 "2018-01-05T09:57:43Z")

</div>

```nohighlight
mutate {
  add_field => {
    "Visitor Type" => "%{rows[0]}"
  }
}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 2, 2018, 9:57am UTC](https://discuss.elastic.co/t/how-to-split-the-records-on-data-with-only-value-and-without-key/114134/4 "2018-02-02T09:57:57Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.