# Logstash - split array into individual events
**URL:** https://discuss.elastic.co/t/logstash-split-array-into-individual-events/181422
**Category:** Logstash
**Created:** [May 16, 2019, 2:10pm UTC](https://discuss.elastic.co/t/logstash-split-array-into-individual-events/181422 "2019-05-16T14:10:07Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@RonGros](https://discuss.elastic.co/u/RonGros)
#### Post date: [May 16, 2019, 2:10pm UTC](https://discuss.elastic.co/t/logstash-split-array-into-individual-events/181422/1 "2019-05-16T14:10:08Z")
Hi!
One of our logs contains lines of arrays of json objects.... I want to take each one of the items in the array and make it a single even.
I read some posts on how to do it :
[https://discuss.elastic.co/t/split-nested-json-array/147969](https://discuss.elastic.co/t/split-nested-json-array/147969)
[https://stackoverflow.com/questions/30558535/logstash-how-do-i-split-an-array-using-the-split-filter-without-a-target](https://stackoverflow.com/questions/30558535/logstash-how-do-i-split-an-array-using-the-split-filter-without-a-target)
But I was not able to make mine work....
Here is what a line looks like for me:
[{"timeStarted": "2019-05-13T09:03:34.995Z","operations": {"operation 1" { ... } "operation 2" { ... }} },{"timeStarted": "2019-05-13T09:03:35.000Z","operations": {"operation 1" { ... } "operation 2" { ... }}]
and this is what I tried with my conf:
```
filter {
split {
field => "message"
target => "events"
add_field => {
"operations" => "%{operations}"
"timeStarted" => "%{timeStarted}"
}
}
mutate {
add_field => {
"site" => "%{path}"
#"operations" => "%{[events][operations]"
#"timeStarted" => "%{[events][timeStarted]"
}
remove_field => ["[message]"]
}
date {
match => ["[timeStarted]", "yyyy-MM-dd'T'HH:mm:ss.SSS"]
}
}
```
I tried different options, but I could not get the fields out. I only get 1 event per line and get parse error for the fields...
I tried adding the fields both as part of the split and as part of a mutate, neither of them worked for me
any idea?
Thanks!!!
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [May 16, 2019, 2:42pm UTC](https://discuss.elastic.co/t/logstash-split-array-into-individual-events/181422/2 "2019-05-16T14:42:06Z")
> [@RonGros](#):
>
> [{"timeStarted": "2019-05-13T09:03:34.995Z","operations": {"operation 1" { ... } "operation 2" { ... }} },{"timeStarted": "2019-05-13T09:03:35.000Z","operations": {"operation 1" { ... } "operation 2" { ... }}]
If that is the content of [message] then
```
input { generator { count => 1 lines => ['[{"timeStarted": "2019-05-13T09:03:34.995Z","operations": {"operation 1": 1, "operation 2": 2 } },{"timeStarted": "2019-05-13T09:03:35.000Z","operations": {"operation 1": 1, "operation 2": 2 } }]' ] } }
filter {
json { source => "message" target => "someField" }
split { field => "someField" }
}
```
will work. Note that since it is an array the target option on the json filter is required.
---
### Author:  [@RonGros](https://discuss.elastic.co/u/RonGros)
#### Post date: [May 16, 2019, 2:44pm UTC](https://discuss.elastic.co/t/logstash-split-array-into-individual-events/181422/3 "2019-05-16T14:44:06Z")
What the first line means (input generator)?
is this just to test instead of the file input we use?
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [May 16, 2019, 2:44pm UTC](https://discuss.elastic.co/t/logstash-split-array-into-individual-events/181422/4 "2019-05-16T14:44:34Z")
> [@RonGros](#):
>
> is this just to test instead of the file input we use?
Yes.
---
### Author:  [@RonGros](https://discuss.elastic.co/u/RonGros)
#### Post date: [May 16, 2019, 2:47pm UTC](https://discuss.elastic.co/t/logstash-split-array-into-individual-events/181422/5 "2019-05-16T14:47:18Z")
Thanks
can you explain - is this what you meant or a typo -
> filter {
> json { source =\> "message" target =\> "someField" }
> split { field =\> "someField" }
> }
In both the output is "someField" yet the split input is field which is undefined... did you mean that the json target is field or someField?
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [May 16, 2019, 3:15pm UTC](https://discuss.elastic.co/t/logstash-split-array-into-individual-events/181422/6 "2019-05-16T15:15:11Z")
> [@RonGros](#):
>
> split { field =\> "someField" }
This tells the split filter to operate upon a field called "someField". That name has to match the target of the json filter.
---
### Author:  [@RonGros](https://discuss.elastic.co/u/RonGros)
#### Post date: [May 19, 2019, 6:17am UTC](https://discuss.elastic.co/t/logstash-split-array-into-individual-events/181422/7 "2019-05-19T06:17:45Z")
Thanks! it worked!!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 16, 2019, 6:17am UTC](https://discuss.elastic.co/t/logstash-split-array-into-individual-events/181422/8 "2019-06-16T06:17:45Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.