# Logstash JDBC string column value to array data type

**URL:** <https://discuss.elastic.co/t/logstash-jdbc-string-column-value-to-array-data-type/62436>\
**Category:** Logstash\
**Created:** [October 6, 2016, 8:34pm UTC](https://discuss.elastic.co/t/logstash-jdbc-string-column-value-to-array-data-type/62436 "2016-10-06T20:34:04Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![simon80](https://avatars.discourse-cdn.com/v4/letter/s/9de053/32.png) [@simon80](https://discuss.elastic.co/u/simon80)\
**Post date:** [October 6, 2016, 8:34pm UTC](https://discuss.elastic.co/t/logstash-jdbc-string-column-value-to-array-data-type/62436/1 "2016-10-06T20:34:04Z")

</div>

I would like to provide a SQL column value that contains concatenated strings (i.e. "value1,value2,value3") and have this value 'split' into an array data type within ElasticSearch.

I've looked at the 'join' mutator and the 'split' function but I can't seem to get it right.

I am currently using a mutator to convert lat/lon to geo\_point in another configuration and the syntax makes sense as a whole; I have not been as successful with the above use case, however.

Seems I would need to split and then join. Am I adding new fields as I go and then later removing the temporary fields?

Does anyone have an example of how I might go about this?

Thank you.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 7, 2016, 5:39am UTC](https://discuss.elastic.co/t/logstash-jdbc-string-column-value-to-array-data-type/62436/2 "2016-10-07T05:39:18Z")

</div>

I'm not quite following. You want an array in Elasticsearch? Then the mutate filter's split option is the way to go. I don't get why you'd want to join anything. Showing a concrete example (copy/paste, no screenshots please) of exactly what you have and what you'd like the resulting JSON document to look like would be helpful.

---

<div class="post-metadata">

**Author:** ![simon80](https://avatars.discourse-cdn.com/v4/letter/s/9de053/32.png) [@simon80](https://discuss.elastic.co/u/simon80)\
**Post date:** [October 7, 2016, 12:52pm UTC](https://discuss.elastic.co/t/logstash-jdbc-string-column-value-to-array-data-type/62436/3 "2016-10-07T12:52:28Z")

</div>

Thanks for the response. Out of brevity, I will provide some in-complete code in regards to the JDBC aspect of my Logstash config and focus on the filter/split portion. Thanks for your assistance.

In my template's mapping, let's say I have a property called "files" which is defined as an array.

input {  
jdbc {  
statement =\> "select file1 || ',' || file2 as files\_str from some\_table"  
}

}  
filter {  
split {  
# I would like to split the "files\_str" column value into ab array for storage as "files"  
# Do I add a field called "files" first?  
}  
}  
output {  
elasticsearch {  
index =\> "file-data-%{YYY.MM.dd}"  
document\_type =\> "file"  
hosts =\> ["myhost"]  
}  
}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 7, 2016, 1:19pm UTC](https://discuss.elastic.co/t/logstash-jdbc-string-column-value-to-array-data-type/62436/4 "2016-10-07T13:19:36Z")

</div>

No, don't use the split filter. Use the mutate filter's split option. It'll split the string in place so you don't need a temporary field.

```nohighlight
...
    statement => "select file1 || ',' || file2 as files from some_table"
...

filters {
  mutate {
    split {
      "files" => ","
    }
  }
}

```

---

<div class="post-metadata">

**Author:** ![simon80](https://avatars.discourse-cdn.com/v4/letter/s/9de053/32.png) [@simon80](https://discuss.elastic.co/u/simon80)\
**Post date:** [October 7, 2016, 1:58pm UTC](https://discuss.elastic.co/t/logstash-jdbc-string-column-value-to-array-data-type/62436/5 "2016-10-07T13:58:22Z")

</div>

Much appreciated; I didn't realize that 'split' within the mutate context was what I needed. Thanks again.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:35am UTC](https://discuss.elastic.co/t/logstash-jdbc-string-column-value-to-array-data-type/62436/6 "2017-07-06T04:35:13Z")

</div>