# Kibana Index - Splitting Index Values and Adding to New Field **URL:** \ **Category:** Logstash\ **Created:** [July 28, 2020, 12:03pm UTC](https://discuss.elastic.co/t/kibana-index-splitting-index-values-and-adding-to-new-field/242896 "2020-07-28T12:03:22Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![Kevin\_f](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kevin_f/32/72456_2.png) [@Kevin\_f](https://discuss.elastic.co/u/Kevin_f)\ **Post date:** [July 28, 2020, 12:03pm UTC](https://discuss.elastic.co/t/kibana-index-splitting-index-values-and-adding-to-new-field/242896/1 "2020-07-28T12:03:22Z")
Hello, I am trying to figure out how to split the value of an index field and add that to a new field. Basically what I have on Kibana is as shown: ![image](https://us1.discourse-cdn.com/elastic/original/3X/3/0/30df6328f0986bcf0356c0c33e38e88449b874ae.png) This is the json document output of the index fields: ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/9/e9b8cc54ff16032fc59e844089e2d88187af7b3c.png) I am trying to remove the value " **Action: Allow**" and add it to a new field called "Action". This is what I have within my logstash config: ```auto filter { if [service] == "network" { #mutate { # copy => { "properties.msg" => "Action:*"} #} mutate { split => {"properties.msg" => "Action:"} } mutate { add_field => { "Action" => "%{[properties.msg][1]}"} } } } ``` With this config, I am getting this: ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/3/839655497fd7f5eba22c4967b2809331804836b0.png) Help would be much appreciated. Thanks. ---
**Author:** ![Jenni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jenni/32/29684_2.png) [@Jenni](https://discuss.elastic.co/u/Jenni)\ **Post date:** [July 28, 2020, 12:09pm UTC](https://discuss.elastic.co/t/kibana-index-splitting-index-values-and-adding-to-new-field/242896/2 "2020-07-28T12:09:25Z")
You don't have a field `properties.msg`. That would mean that there is a dot within the field name, not that there is a subfield. It's `[properties][msg]` 🙂 ---
**Author:** ![kelk](https://avatars.discourse-cdn.com/v4/letter/k/13edae/32.png) [@kelk](https://discuss.elastic.co/u/kelk)\ **Post date:** [July 28, 2020, 12:12pm UTC](https://discuss.elastic.co/t/kibana-index-splitting-index-values-and-adding-to-new-field/242896/3 "2020-07-28T12:12:25Z")
> [@Kevin\_f](#): > Will this work for you? ```auto filter { if [service] == "network" { grok { match => { "[properties][msg]" => "%{GREEDYDATA:preData}\s*Action\:\s*%{WORD:Action}" } } } } ``` ---
**Author:** ![Kevin\_f](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kevin_f/32/72456_2.png) [@Kevin\_f](https://discuss.elastic.co/u/Kevin_f)\ **Post date:** [July 28, 2020, 12:15pm UTC](https://discuss.elastic.co/t/kibana-index-splitting-index-values-and-adding-to-new-field/242896/4 "2020-07-28T12:15:15Z")
Hi Jenni, Ahh my bad. So I have changed the logstash config to: ```auto filter { if [service] == "network" { mutate { split => {"properties.msg" => "Action:"} } mutate { add_field => { "Action" => "%{[properties][msg][1]}"} } } } ``` And now getting the output on Kibana as: ![image](https://us1.discourse-cdn.com/elastic/original/3X/1/b/1b053ad2a2f35c1eb47f88fe929944188038c54e.png) ---
**Author:** ![Kevin\_f](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kevin_f/32/72456_2.png) [@Kevin\_f](https://discuss.elastic.co/u/Kevin_f)\ **Post date:** [July 28, 2020, 12:15pm UTC](https://discuss.elastic.co/t/kibana-index-splitting-index-values-and-adding-to-new-field/242896/5 "2020-07-28T12:15:47Z")
Hi Kin, Interesting method. I will give this a go as well. Many thanks. ---
**Author:** ![Jenni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jenni/32/29684_2.png) [@Jenni](https://discuss.elastic.co/u/Jenni)\ **Post date:** [July 28, 2020, 12:19pm UTC](https://discuss.elastic.co/t/kibana-index-splitting-index-values-and-adding-to-new-field/242896/6 "2020-07-28T12:19:52Z")
You'd have to change this at both places. And have a look at the dissect filter which would be a prettier solution. Grok is actually a bit much for such an easy split because it uses regular expressions where they are not neccessary. ---
**Author:** ![Kevin\_f](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kevin_f/32/72456_2.png) [@Kevin\_f](https://discuss.elastic.co/u/Kevin_f)\ **Post date:** [July 28, 2020, 12:19pm UTC](https://discuss.elastic.co/t/kibana-index-splitting-index-values-and-adding-to-new-field/242896/7 "2020-07-28T12:19:54Z")
@kelk unfortunately that config didnt produce anything ---
**Author:** ![Jenni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jenni/32/29684_2.png) [@Jenni](https://discuss.elastic.co/u/Jenni)\ **Post date:** [July 28, 2020, 12:22pm UTC](https://discuss.elastic.co/t/kibana-index-splitting-index-values-and-adding-to-new-field/242896/8 "2020-07-28T12:22:35Z")
Here you go: ```auto dissect { mapping => { "[properties][msg]" => "%{[properties][msg]} Action: %{Action}" } } ``` ---
**Author:** ![Kevin\_f](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kevin_f/32/72456_2.png) [@Kevin\_f](https://discuss.elastic.co/u/Kevin_f)\ **Post date:** [July 28, 2020, 12:35pm UTC](https://discuss.elastic.co/t/kibana-index-splitting-index-values-and-adding-to-new-field/242896/9 "2020-07-28T12:35:35Z")
@Jenni works like a charm! Much appreciated. Thanks. ---
**Author:** ![kelk](https://avatars.discourse-cdn.com/v4/letter/k/13edae/32.png) [@kelk](https://discuss.elastic.co/u/kelk)\ **Post date:** [July 28, 2020, 12:48pm UTC](https://discuss.elastic.co/t/kibana-index-splitting-index-values-and-adding-to-new-field/242896/10 "2020-07-28T12:48:40Z")
sorry, I put `"message" `as it is more common. Updated with `"[properties][msg]"`. Hopefully it should work now ---
**Author:** ![Kevin\_f](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kevin_f/32/72456_2.png) [@Kevin\_f](https://discuss.elastic.co/u/Kevin_f)\ **Post date:** [July 28, 2020, 12:58pm UTC](https://discuss.elastic.co/t/kibana-index-splitting-index-values-and-adding-to-new-field/242896/11 "2020-07-28T12:58:10Z")
@kelk Thanks. Another thing, if I wanted to do the same for the same field i.e. ```auto "properties": { "msg": "UDP request from x.x.x.x:62151 to x.x.x.x:53." ``` To add UDP request from x.x.x.x:62151 to new field called "UDP Request From" AND to add UDP request to x.x.x.x:53 to new field called "UDP Request to" Would this be as simple as using the disect filter again? That the field output would be: ```auto UDP Request From x.x.x.x:62151 ``` ```auto UDP Request To x.x.x.x:53 ``` ```auto UDP Action: Allow ``` ---
**Author:** ![kelk](https://avatars.discourse-cdn.com/v4/letter/k/13edae/32.png) [@kelk](https://discuss.elastic.co/u/kelk)\ **Post date:** [July 28, 2020, 1:07pm UTC](https://discuss.elastic.co/t/kibana-index-splitting-index-values-and-adding-to-new-field/242896/12 "2020-07-28T13:07:12Z")
Because I come from a regex background, I might do all in one shot using grok ```auto UDP request from 192.168.1.1:36877 to 192.168.2.1:53. Action: Allow ``` ```auto filter { if [service] == "network" { grok { match => { "[properties][msg]" => "UDP request from %{IP:source_ip}\:%{NUMBER:source_port} to %{IP:dest_ip}\:%{NUMBER:dest_port}\.\s*Action\:\s*%{WORD:Action}" } } } } ``` ---
**Author:** ![Jenni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jenni/32/29684_2.png) [@Jenni](https://discuss.elastic.co/u/Jenni)\ **Post date:** [July 28, 2020, 1:12pm UTC](https://discuss.elastic.co/t/kibana-index-splitting-index-values-and-adding-to-new-field/242896/13 "2020-07-28T13:12:08Z")
If you do it in an extra step: ```auto dissect { mapping => { "[properties][msg]" => "UDP request from %{UPD Request from} to %{UPD Request to}"} } mutate { gsub => ["UPD Request to", "\.$", ""] } ``` Otherwise: ```auto dissect { mapping => { "[properties][msg]" => "UDP request from %{UPD Request from} to %{UPD Request to}. Action: %{UPD Action}"} } ``` ---
**Author:** ![Kevin\_f](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kevin_f/32/72456_2.png) [@Kevin\_f](https://discuss.elastic.co/u/Kevin_f)\ **Post date:** [July 28, 2020, 1:49pm UTC](https://discuss.elastic.co/t/kibana-index-splitting-index-values-and-adding-to-new-field/242896/14 "2020-07-28T13:49:44Z")
Hi @Jenni and @kelk, That both worked. Thank you very much! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 25, 2020, 1:49pm UTC](https://discuss.elastic.co/t/kibana-index-splitting-index-values-and-adding-to-new-field/242896/15 "2020-08-25T13:49:45Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.