# Logstash filter not able to split **URL:** \ **Category:** Logstash\ **Created:** [June 8, 2016, 11:14am UTC](https://discuss.elastic.co/t/logstash-filter-not-able-to-split/52205 "2016-06-08T11:14:10Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![jagan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jagan/32/42200_2.png) [@jagan](https://discuss.elastic.co/u/jagan)\ **Post date:** [June 8, 2016, 11:14am UTC](https://discuss.elastic.co/t/logstash-filter-not-able-to-split/52205/1 "2016-06-08T11:14:10Z")
Hi Gurus, please help me out . I am trying to split the nested fields in log files but not able to do .Could you please help me out . He is the sample file: Mon May 30 00:30:26 PDT 2016 kthr memory page disk faults cpu r b w swap free re mf pi po fr de sr m0 m1 m2 m3 in sy cs us sy id 4 0 0 2480 3628804 0 0 0 0 0 0 0 5 0 0 0 0 0 0 0 0 99 0 0 0 2480 3628712 0 Mon May 30 00:40:54 PDT 2016 kthr memory page disk faults cpu r b w swap free re mf pi po fr de sr m0 m1 m2 m3 in sy cs us sy id 4 0 0 2480 3710276 0 0 0 0 0 0 0 5 0 0 0 0 0 0 0 0 99 1 0 0 2480 3710336 0 0 0 0 0 0 0 0 0 0 0 .. when i was trying to split the data it is not able to split i got the ouput as follows: PFA ' p1' ![](https://us1.discourse-cdn.com/elastic/original/2X/7/7ea8618424897f835f61d83993de31b1b07f3bf8.png) In the above index data is shown in a single message rather than spliting an individual events. But the expecting output should be similar in selected fields as Kthr.r kthr.b kthr.w memory.free...so on for this i have done splitting using the below code: ```auto input { file { path => "C:\hrd\vmst1.csv" type => "log" start_position => beginning } } filter { if [type] == "vmstat" { if [message] =~ "^procs" { drop {} } csv { separator => " " columns => ["vmstat.r", "vmstat.b", "vmstat.w", "vmstat.swap" ,"vmstat.free", "vmstat.re", "vmstat.mf", "vmstat.pi", "vmstat.po", "vmstat.fr", "vmstat.de", "vmstat.sr", "vmstat.m0", "vmstat.m1", "vmstat.m2", "vmstat.m3", "vmstat.in", "vmstat.cs","vmstat.us","vmstat.sy","vmstat.id"] } mutate { convert => [ "vmstat.r", "integer", "vmstat.b", "integer", "vmstat.w", "integer", "vmstat.swap", "integer", "vmstat.free", "integer", "vmstat.re", "integer", "vmstat.mf", "integer", "vmstat.pi", "integer", "vmstat.po", "integer", "vmstat.fr", "integer", "vmstat.de", "integer", "vmstat.sr", "integer", "vmstat.m0", "integer", "vmstat.m1", "integer", "vmstat.m2", "integer", "vmstat.m3", "integer", "vmstat.in", "integer", "vmstat.cs", "integer", "vmstat.us", "integer", "vmstat.sy", "integer", "vmstat.id", "integer" ] } } } filter { if [type] == "performon" { csv { separator => " " columns => [ "kthr.r", "kthr.b", "kthr.w", "memory.swap", "memory.free", "memory.re", "page.mf", "page.pi", "page.po", "page.fr", "page.de", "page.sr", "disk.m0", "disk.m1", "disk.m2", "disk.m3", "faults.in", "faults.sy", "cpu.cs", "cpu.us", "cpu.sy", "cpu.id" ] } mutate { convert => [ "vmstat.r", "float", "vmstat.b", "float", "vmstat.w", "float", "vmstat.swap", "float", "vmstat.free", "float", "vmstat.re", "float", "vmstat.mf", "float", "vmstat.pi", "float", "vmstat.po", "float", "vmstat.fr", "float", "vmstat.de", "float", "vmstat.sr", "float", "vmstat.m0", "float", "vmstat.m1", "float", "vmstat.m2", "float", "vmstat.m3", "float", "vmstat.in", "float", "vmstat.cs", "float", "vmstat.us", "float", "vmstat.sy", "float", "vmstat.id", "float" ] } } } output { elasticsearch { hosts => "localhost" action => "index" index => "vmstat11" workers => 1 } stdout {codec => rubydebug} } ``` please suggest me Thanks, jagan ---
**Author:** ![purbon](https://avatars.discourse-cdn.com/v4/letter/p/edb3f5/32.png) [@purbon](https://discuss.elastic.co/u/purbon)\ **Post date:** [June 8, 2016, 2:13pm UTC](https://discuss.elastic.co/t/logstash-filter-not-able-to-split/52205/2 "2016-06-08T14:13:30Z")
Hi, your code looks resonable at first look, could you link somehow your sample files and configuration, might be using [http://pastebin.com/](http://pastebin.com/) , this will help others and me debug your issue more in detail. On the other side, which version of logstash are you using? ---
**Author:** ![purbon](https://avatars.discourse-cdn.com/v4/letter/p/edb3f5/32.png) [@purbon](https://discuss.elastic.co/u/purbon)\ **Post date:** [June 8, 2016, 2:16pm UTC](https://discuss.elastic.co/t/logstash-filter-not-able-to-split/52205/3 "2016-06-08T14:16:44Z")
Hi, taking a close look to your config, you assign type == "log" to your events in the input, however in your filter section your do `if [type] == "vmstat"` and the other one is `if [type] == "performon"` so your logs will never enter any of this sections. was this a typo when copying ? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [June 8, 2016, 6:33pm UTC](https://discuss.elastic.co/t/logstash-filter-not-able-to-split/52205/4 "2016-06-08T18:33:33Z")
Keep in mind that ES 2.0 and later don't support periods in the field names so you'll probably want to go with e.g. `vmstat_r` instead of `vmstat.r`. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 4:54am UTC](https://discuss.elastic.co/t/logstash-filter-not-able-to-split/52205/5 "2017-07-06T04:54:04Z")