# Ingest pipeline : dissect log sentence

**URL:** <https://discuss.elastic.co/t/ingest-pipeline-dissect-log-sentence/305690>\
**Category:** Elasticsearch\
**Tags:** ingest-pipeline\
**Created:** [May 26, 2022, 9:03am UTC](https://discuss.elastic.co/t/ingest-pipeline-dissect-log-sentence/305690 "2022-05-26T09:03:55Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Micou12](https://avatars.discourse-cdn.com/v4/letter/m/ad7895/32.png) [@Micou12](https://discuss.elastic.co/u/Micou12)\
**Post date:** [May 26, 2022, 9:03am UTC](https://discuss.elastic.co/t/ingest-pipeline-dissect-log-sentence/305690/1 "2022-05-26T09:03:55Z")

</div>

Hello All , would like to request a help on how to split a sentence into small chunk . for example I am making a pipeline from custom integration through kibana dashboard , the log is like this: [name=tamari.mpaka@apm.rw;mid=51;ip=10.17.42.171;ua=iPhone Mail/19E258;cid=10942;]  
I want to remain with the field like this :  
mailbox\_name: " tamari.mpaka@apm.rw"  
ip: "10.17.42.171"

others should be ignored"

please help me

Michel

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [June 2, 2022, 1:38am UTC](https://discuss.elastic.co/t/ingest-pipeline-dissect-log-sentence/305690/2 "2022-06-02T01:38:14Z")

</div>

Welcome to our community! 😃

Just so I am clear, are you wanting to split on `;`?

---

<div class="post-metadata">

**Author:** ![Micou12](https://avatars.discourse-cdn.com/v4/letter/m/ad7895/32.png) [@Micou12](https://discuss.elastic.co/u/Micou12)\
**Post date:** [June 10, 2022, 12:34pm UTC](https://discuss.elastic.co/t/ingest-pipeline-dissect-log-sentence/305690/3 "2022-06-10T12:34:10Z")

</div>

Exactly , you are right.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [June 14, 2022, 12:27am UTC](https://discuss.elastic.co/t/ingest-pipeline-dissect-log-sentence/305690/4 "2022-06-14T00:27:38Z")

</div>

Take a look at [Split processor | Elasticsearch Guide [8.2] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/split-processor.html) then.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 12, 2022, 12:28am UTC](https://discuss.elastic.co/t/ingest-pipeline-dissect-log-sentence/305690/5 "2022-07-12T00:28:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.