# Is it possible to split discovery message field?

**URL:** <https://discuss.elastic.co/t/is-it-possible-to-split-discovery-message-field/96376>\
**Category:** Kibana\
**Created:** [August 9, 2017, 6:06am UTC](https://discuss.elastic.co/t/is-it-possible-to-split-discovery-message-field/96376 "2017-08-09T06:06:40Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![spalger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spalger/32/14092_2.png) [@spalger](https://discuss.elastic.co/u/spalger)\
**Post date:** [August 9, 2017, 10:30pm UTC](https://discuss.elastic.co/t/is-it-possible-to-split-discovery-message-field/96376/2 "2017-08-09T22:30:16Z")

</div>

You could use scripted fields to do this at query time using regular expressions, or string manipulation, but that will not be efficient and will be pretty brittle. The correct way to do it would be with a tool like Logstash, which would split the string up before writing the message to Elasticsearch. Then Kibana would be able to fully utilize the values in there, and things like dates, numbers, etc, would be typed correctly and searchable/filterable/aggregatable

---

_[View the full topic](https://discuss.elastic.co/t/is-it-possible-to-split-discovery-message-field/96376)._