# Logstash 6.4.1 Docker mutate split issue

**URL:** <https://discuss.elastic.co/t/logstash-6-4-1-docker-mutate-split-issue/153760>\
**Category:** Logstash\
**Created:** [October 24, 2018, 9:28am UTC](https://discuss.elastic.co/t/logstash-6-4-1-docker-mutate-split-issue/153760 "2018-10-24T09:28:22Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![elastic3](https://avatars.discourse-cdn.com/v4/letter/e/ce73a5/32.png) [@elastic3](https://discuss.elastic.co/u/elastic3)\
**Post date:** [October 24, 2018, 9:28am UTC](https://discuss.elastic.co/t/logstash-6-4-1-docker-mutate-split-issue/153760/1 "2018-10-24T09:28:23Z")

</div>

Hi,

I am trying to use mutate split on '\t' (tab) but it only splits once as shown below. I even tried to convert it to string using mutate -convert field to string. Is it the double quotes? I even tried to escape the backslash '\t'

```
mutate {
   convert => { "trapVariables" => "string" }
}
mutate {
   split => { "trapVariables" => "\t" }
}

```

The output looks like this:

```
"trapVariables" => [
        [0] "DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (3299021) 9:09:50.21\tSNMPv2-MIB::snmpTrapOID.0 = OID: IF-MIB::linkDown\tIF-MIB::ifIndex.528 = INTEGER: 528\tIF-MIB::ifAdminStatus.528 = INTEGER: down(2)\tIF-MIB::ifOperStatus.528 = INTEGER: down(2)\tIF-MIB::ifName.528 = STRING: ge-0/0/9"
    ],

```

Appreciate help on this, please.  
I believe split would help to get different sections of the varbinds. I also tried kv but there seems to be an issue with it that trim key is unknown and log stash fails to start.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 21, 2018, 9:28am UTC](https://discuss.elastic.co/t/logstash-6-4-1-docker-mutate-split-issue/153760/2 "2018-11-21T09:28:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.