# Logstash mutate split but maintain the separator character

**URL:** https://discuss.elastic.co/t/logstash-mutate-split-but-maintain-the-separator-character/130338
**Category:** Logstash
**Created:** [May 2, 2018, 11:31pm UTC](https://discuss.elastic.co/t/logstash-mutate-split-but-maintain-the-separator-character/130338 "2018-05-02T23:31:00Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![safehouse](https://avatars.discourse-cdn.com/v4/letter/s/f475e1/32.png) [@safehouse](https://discuss.elastic.co/u/safehouse)
#### Post date: [May 2, 2018, 11:31pm UTC](https://discuss.elastic.co/t/logstash-mutate-split-but-maintain-the-separator-character/130338/1 "2018-05-02T23:31:00Z")

</div>

I want to split a field into an array, but I want the array values to keep the separator characters. It seems that the way mutate split works is to remove the separator characters.

Is there another way to accomplish this?

So, if my field has a value of:

```
linux-image-4.4.0-1054-aws:amd64 (4.4.0-1054.63, automatic), linux-headers-4.4.0-1054-aws:amd64 (4.4.0-1054.63, automatic), linux-aws-headers-4.4.0-1054:amd64 (4.4.0-1054.63, automatic)

```

I want to separate this by matching "), " so that I would get an array like this:

```
linux-image-4.4.0-1054-aws:amd64 (4.4.0-1054.63, automatic), 
linux-headers-4.4.0-1054-aws:amd64 (4.4.0-1054.63, automatic), 
linux-aws-headers-4.4.0-1054:amd64 (4.4.0-1054.63, automatic)

```

But using mutate split I get:

```
linux-image-4.4.0-1054-aws:amd64 (4.4.0-1054.63, automatic, 
linux-headers-4.4.0-1054-aws:amd64 (4.4.0-1054.63, automatic, 
linux-aws-headers-4.4.0-1054:amd64 (4.4.0-1054.63, automatic

```

(missing the closing parenthesis - which I need for future grok parsing)

Any suggestions on any method of accomplishing this would be huge!

---

<div class="post-metadata">

### Author: ![yaauie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yaauie/32/23363_2.png) [@yaauie](https://discuss.elastic.co/u/yaauie)
#### Post date: [May 3, 2018, 12:04am UTC](https://discuss.elastic.co/t/logstash-mutate-split-but-maintain-the-separator-character/130338/2 "2018-05-03T00:04:54Z")

</div>

Since the mutate filter applies gsub directives _before_ split directives, it is possible to use a positive-lookbehind assertion to inject a character on which we can later split:

- pattern: `"(?<=\)), "` a comma-space sequence that is preceeded by a literal closing paren
- replacement: `"|"` a pipe character (whatever sequence you use _MUST NOT_ appear naturally in your messages)

```auto
filter {
	mutate {
	    # replace any comma-space that is preceeded by a closing paren with a pipe
		gsub => ["message", "(?<=\)), ", "|"]
		# split on the pipe
		split => { "message" => "|" }
	}
}

```

With the input you gave as the `message` on Logstash 6.2.2, the above filter gave me output that is likely what you expect:

```auto
{
       "message" => [
        [0] "linux-image-4.4.0-1054-aws:amd64 (4.4.0-1054.63, automatic)",
        [1] "linux-headers-4.4.0-1054-aws:amd64 (4.4.0-1054.63, automatic)",
        [2] "linux-aws-headers-4.4.0-1054:amd64 (4.4.0-1054.63, automatic)"
    ],
    "@timestamp" => 2018-05-03T00:00:18.026Z,
      "@version" => "1",
          "host" => "castrovel.local"
}

```

---

<div class="post-metadata">

### Author: ![safehouse](https://avatars.discourse-cdn.com/v4/letter/s/f475e1/32.png) [@safehouse](https://discuss.elastic.co/u/safehouse)
#### Post date: [May 3, 2018, 10:37am UTC](https://discuss.elastic.co/t/logstash-mutate-split-but-maintain-the-separator-character/130338/3 "2018-05-03T10:37:01Z")

</div>

Dude! Yes! This works perfectly.

Thank you for your help. I appreciate it.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 31, 2018, 10:37am UTC](https://discuss.elastic.co/t/logstash-mutate-split-but-maintain-the-separator-character/130338/4 "2018-05-31T10:37:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.