# Is it possible to split discovery message field?
**URL:** https://discuss.elastic.co/t/is-it-possible-to-split-discovery-message-field/96376
**Category:** Kibana
**Created:** [August 9, 2017, 6:06am UTC](https://discuss.elastic.co/t/is-it-possible-to-split-discovery-message-field/96376 "2017-08-09T06:06:40Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@abu.sayeed](https://discuss.elastic.co/u/abu.sayeed)
#### Post date: [August 9, 2017, 6:06am UTC](https://discuss.elastic.co/t/is-it-possible-to-split-discovery-message-field/96376/1 "2017-08-09T06:06:40Z")
Elasticsearch version 5.5.1
kibana version 5.5.1
Logstash version 5.5.1
Beats version 5.5.1
my message field:
message:[INFO] Status =\> SENT | client : [IPDC] | cell : [1746710009] | message-delivery-time : [2017-08-07 09:46:27,807] | Operator: [ROBI]
I would like to split according to Status, Client, Operator and message-delivery-time.
I wish any expert will help me.
Thanks
---
### Author:  [@spalger](https://discuss.elastic.co/u/spalger)
#### Post date: [August 9, 2017, 10:30pm UTC](https://discuss.elastic.co/t/is-it-possible-to-split-discovery-message-field/96376/2 "2017-08-09T22:30:16Z")
You could use scripted fields to do this at query time using regular expressions, or string manipulation, but that will not be efficient and will be pretty brittle. The correct way to do it would be with a tool like Logstash, which would split the string up before writing the message to Elasticsearch. Then Kibana would be able to fully utilize the values in there, and things like dates, numbers, etc, would be typed correctly and searchable/filterable/aggregatable
---
### Author:  [@abu.sayeed](https://discuss.elastic.co/u/abu.sayeed)
#### Post date: [August 13, 2017, 9:20am UTC](https://discuss.elastic.co/t/is-it-possible-to-split-discovery-message-field/96376/3 "2017-08-13T09:20:56Z")
my logstash.conf
filter {
mutate {
remove\_field =\> ["type", "tags", "input\_type", "@version", "beat", "offset"]
}
}
my discovery logs format:
@timestamp:August 8th 2017, 13:45:54.424 host:vNTDACLSnTALK01 source:/home/local/group/nazdaq/logs/naztech.log message:[INFO] Status =\> SENT | client : [MTB] | cell : [1746710009] | message-delivery-time : [2017-08-07 09:46:27,807] | Operator: [GP]
Available field:
@timestamp
message
host message
source
I need available field:
@timestamp
message
host message
**source**
**status**
**client**
**operator**
What can I do? Please anybody help me.
thanks
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 10, 2017, 9:21am UTC](https://discuss.elastic.co/t/is-it-possible-to-split-discovery-message-field/96376/4 "2017-09-10T09:21:18Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.