# I want to split from filed value using logstash

**URL:** <https://discuss.elastic.co/t/i-want-to-split-from-filed-value-using-logstash/333059>\
**Category:** Logstash\
**Created:** [May 10, 2023, 9:27am UTC](https://discuss.elastic.co/t/i-want-to-split-from-filed-value-using-logstash/333059 "2023-05-10T09:27:58Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![dharminfadia](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dharminfadia/32/119587_2.png) [@dharminfadia](https://discuss.elastic.co/u/dharminfadia)\
**Post date:** [May 10, 2023, 9:27am UTC](https://discuss.elastic.co/t/i-want-to-split-from-filed-value-using-logstash/333059/1 "2023-05-10T09:27:58Z")

</div>

@warkolm @Badger help me....

Hello Everyone

I am trying to split recipient-status feild first 3 digit and want to add in to new feild I tried mutate split and add filed but no luck can any one suggest how I can achive this ???

**Sample logs**

05/01/23 23:59:57 SMTP-OU 0CAB49668DD74D988109ASDEDFA0E602.MAI 1796 0.0.0.0 CONN 220 docomo.ne.jp ESMTP Service Ready 0 38 =?utf-8?B?44GC44Gq44Gf44Gu54Sh5paZ44Gu5q+N44Gu5pel44Kq44O8?=

**Logstash Configuration**

input {  
stdin { }  
}

filter {  
csv {  
separator =\> " "  
columns =\> ["datetime","transactiontype","messageid","remoteport","remoteip","smtocommand1","smtpcommand2","recipient-status","BytesRecv","BytesSent","column11","subject"]  
}  
}

filter {  
mutate {  
remove\_field =\> ["[event][original]"]

# remove\_field =\> ["message"]

```
}
}

```

filter {  
mutate {  
gsub =\> [  
"subject", "=?\w{3}-\d?\w?.\*", ""

]  
}  
}

filter{  
mutate {  
split =\> { "recipient-status" =\> "\d{3}" }  
add\_field =\> { "statuscode" =\> "%{[recipient-status][0]}"}  
}  
}

output {  
stdout {  
codec =\> rubydebug  
}  
}

---

<div class="post-metadata">

**Author:** ![cperzrt10](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cperzrt10/32/116152_2.png) [@cperzrt10](https://discuss.elastic.co/u/cperzrt10)\
**Post date:** [May 10, 2023, 3:09pm UTC](https://discuss.elastic.co/t/i-want-to-split-from-filed-value-using-logstash/333059/2 "2023-05-10T15:09:25Z")

</div>

Have you try grok? Because if you aply the split by spaces it will fail your sample data have more spaces that columns.

With grok you can use regular expresions to mach and catch the data with all your requirements

---

<div class="post-metadata">

**Author:** ![dharminfadia](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dharminfadia/32/119587_2.png) [@dharminfadia](https://discuss.elastic.co/u/dharminfadia)\
**Post date:** [May 10, 2023, 4:02pm UTC](https://discuss.elastic.co/t/i-want-to-split-from-filed-value-using-logstash/333059/3 "2023-05-10T16:02:45Z")

</div>

Hello @cperzrt10

Thank you for reply

I tried first with grok pattern but the problem is my file having 40-50 lacs raw and all every time detect new pattern so I choose this option this thing is split with tab and count as csv  
delimetter but I want to perfrom so field slipt and that value I want to add in to new feild so any one have Idea they can help me..

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [May 10, 2023, 10:27pm UTC](https://discuss.elastic.co/t/i-want-to-split-from-filed-value-using-logstash/333059/4 "2023-05-10T22:27:03Z")

</div>

@dharminfadia please don't ping people that aren't already taking part in your topic like that.

---

<div class="post-metadata">

**Author:** ![dharminfadia](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dharminfadia/32/119587_2.png) [@dharminfadia](https://discuss.elastic.co/u/dharminfadia)\
**Post date:** [May 11, 2023, 2:26am UTC](https://discuss.elastic.co/t/i-want-to-split-from-filed-value-using-logstash/333059/5 "2023-05-11T02:26:19Z")

</div>

Ok thank you for reply

---

<div class="post-metadata">

**Author:** ![cperzrt10](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cperzrt10/32/116152_2.png) [@cperzrt10](https://discuss.elastic.co/u/cperzrt10)\
**Post date:** [May 11, 2023, 6:38am UTC](https://discuss.elastic.co/t/i-want-to-split-from-filed-value-using-logstash/333059/6 "2023-05-11T06:38:23Z")

</div>

But you dont indicate the tab in the split filter you put space

```auto
filter {
  csv {
    separator => " "
    columns => ["datetime","transactiontype","messageid","remoteport","remoteip","smtocommand1","smtpcommand2","recipient-status","BytesRecv","BytesSent","column11","subject"]
  }
}

```

I think that the tab separator is

```auto
separator => "	"

```

---

<div class="post-metadata">

**Author:** ![dharminfadia](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dharminfadia/32/119587_2.png) [@dharminfadia](https://discuss.elastic.co/u/dharminfadia)\
**Post date:** [May 11, 2023, 6:59am UTC](https://discuss.elastic.co/t/i-want-to-split-from-filed-value-using-logstash/333059/7 "2023-05-11T06:59:07Z")

</div>

@cperzrt10

Thank you for reply

Actully for CSV filter \t is not working we have to manually tab between quots so that's the reason I metnion instead of \t to tab so it is showing space..

---

<div class="post-metadata">

**Author:** ![cperzrt10](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cperzrt10/32/116152_2.png) [@cperzrt10](https://discuss.elastic.co/u/cperzrt10)\
**Post date:** [May 12, 2023, 6:12am UTC](https://discuss.elastic.co/t/i-want-to-split-from-filed-value-using-logstash/333059/8 "2023-05-12T06:12:50Z")

</div>

Can you post the sample post using the blockquote option to see the tabs?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 9, 2023, 6:13am UTC](https://discuss.elastic.co/t/i-want-to-split-from-filed-value-using-logstash/333059/9 "2023-06-09T06:13:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.