# Logstash Create and Access Array

**URL:** https://discuss.elastic.co/t/logstash-create-and-access-array/47607
**Category:** Logstash
**Created:** [April 18, 2016, 6:07am UTC](https://discuss.elastic.co/t/logstash-create-and-access-array/47607 "2016-04-18T06:07:26Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![stefansaye](https://avatars.discourse-cdn.com/v4/letter/s/df788c/32.png) [@stefansaye](https://discuss.elastic.co/u/stefansaye)
#### Post date: [April 18, 2016, 6:07am UTC](https://discuss.elastic.co/t/logstash-create-and-access-array/47607/1 "2016-04-18T06:07:26Z")

</div>

hi logstash,

Is it possible to spilt the log as below based on ',' to array ?

"message" =\> "....",  
"host" =\> "10.10.11.12",  
"@version" =\> "1",  
"@timestamp" =\> "2016-04-13T01:52:43.535Z",  
"DISMAN-EVENT-MIB::sysUpTimeInstance" =\> "22 days, 16:33:23.24",  
"sixth\_filed::bgpPeerLastError\_A\_1\_1\_1\_1" =\> "sixth\_filed\_content",  
"seven\_filed::bgpPeerLastError\_A\_1\_1\_1\_1" =\> "seven\_filed\_content",  
"source\_ip" =\> "10.10.11.12"

array looks like ,  
[message] = "...",  
[host] = "10.10.11.12",  
[version] = "1",  
[timestamp]="2016-04-13T01:52:43.535Z"  
....... ..

Any and all help is much appreciated!

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [April 19, 2016, 6:02am UTC](https://discuss.elastic.co/t/logstash-create-and-access-array/47607/2 "2016-04-19T06:02:26Z")

</div>

Sorry, I don't understand. What's the string you want to split? You're showing two map-like representations of log messages but no comma-separated string and no array.

---

<div class="post-metadata">

### Author: ![stefansaye](https://avatars.discourse-cdn.com/v4/letter/s/df788c/32.png) [@stefansaye](https://discuss.elastic.co/u/stefansaye)
#### Post date: [April 19, 2016, 7:26am UTC](https://discuss.elastic.co/t/logstash-create-and-access-array/47607/3 "2016-04-19T07:26:53Z")

</div>

I want to spilt the log based on ", as follows,

> "message" =\> #\<SNMP::SNMPv1\_Trap:0x8054b7d @enterprise=[1.3.6.1.4.1.9.9.187], @timestamp=#\<SNMP::TimeTicks:0x60589092 @value=906196836\>, @varbind\_list=[#\<SNMP::VarBind:0x796f52ad @name=[1.3.6.1.2.1.15.3.1.14.211.79.48.54], @value="\x00\x00"\>, #\<SNMP::VarBind:0x5b13b05e @name=[1.3.6.1.2.1.15.3.1.2.211.79.48.54], @value=#\<SNMP::Integer:0x7f6b77ae @value=1\>\>, #\<SNMP::VarBind:0x731481c5 @name=[1.3.6.1.4.1.9.9.187.1.2.1.1.7.10.10.11.12], @value=""\>, #\<SNMP::VarBind:0x706d5f30 @name=[1.3.6.1.4.1.9.9.187.1.2.1.1.8.10.10.11.12], @value=#\<SNMP::Integer:0x36ba8023 @value=3\>\>], @specific\_trap=1, @source\_ip="10.10.11.12", @agent\_addr=#\<SNMP::IpAddress:0x1248575d @value="\xC0\xA8\a\f"\>, @generic\_trap=6\>",  
> "host" =\> "10.10.11.12",  
> "@version" =\> "1",  
> "@timestamp" =\> "2016-04-13T01:52:43.535Z",  
> "DISMAN-EVENT-MIB::sysUpTimeInstance" =\> "22 days, 16:33:23.24",  
> "sixth\_filed::bgpPeerLastError\_A\_1\_1\_1\_1" =\> "sixth\_filed\_content",  
> "seven\_filed::bgpPeerLastError\_A\_1\_1\_1\_1" =\> "seven\_filed\_content",  
> "source\_ip" =\> "10.10.11.12"

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [April 19, 2016, 8:29am UTC](https://discuss.elastic.co/t/logstash-create-and-access-array/47607/4 "2016-04-19T08:29:00Z")

</div>

Have you looked at the kv filter? Or, if you really want an array rather than a set of fields, the mutate filter's split option?

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:01am UTC](https://discuss.elastic.co/t/logstash-create-and-access-array/47607/5 "2017-07-06T05:01:39Z")

</div>