# Logstash split function

**URL:** <https://discuss.elastic.co/t/logstash-split-function/233164>\
**Category:** Logstash\
**Created:** [May 18, 2020, 5:23pm UTC](https://discuss.elastic.co/t/logstash-split-function/233164 "2020-05-18T17:23:49Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![hariskhalique](https://avatars.discourse-cdn.com/v4/letter/h/a3d4f5/32.png) [@hariskhalique](https://discuss.elastic.co/u/hariskhalique)\
**Post date:** [May 18, 2020, 5:23pm UTC](https://discuss.elastic.co/t/logstash-split-function/233164/1 "2020-05-18T17:23:49Z")

</div>

Hi,  
I have this tag fields with value

```
 Beige, Black, Blue, boohoo, Brown, cat:dresses, DZZ56895, Green, Grey, New Arrivals, Orange, Pink, Purple, Red, subcat:cocktail:cat:dresses, White, women, Yellow, z_global_id:39039

```

I want to split with "," and then with ":". If array count is more then one odd will be filed name and even will be field value.

I am not sure how because I new to logstash. Please any one can help me.

Thanks in advance.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 18, 2020, 5:51pm UTC](https://discuss.elastic.co/t/logstash-split-function/233164/2 "2020-05-18T17:51:06Z")

</div>

You can use a [mutate+split](https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-split) filter to convert a string into an array of strings.

It is unclear what you want to do with the fields containing a colon.

---

<div class="post-metadata">

**Author:** ![hariskhalique](https://avatars.discourse-cdn.com/v4/letter/h/a3d4f5/32.png) [@hariskhalique](https://discuss.elastic.co/u/hariskhalique)\
**Post date:** [May 18, 2020, 5:56pm UTC](https://discuss.elastic.co/t/logstash-split-function/233164/3 "2020-05-18T17:56:28Z")

</div>

if split with ":" say cat:dresses it become array ["cat", "dresses"]. Then I want "cat" as field and "dresses" as value in ES document.

```
{
  name: "some product",
  cat : "dresses"
}

```

name will be other field pull along with this tag field.This how I want to save in elastic search.

Thanks I hope this time is more clear.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 18, 2020, 6:09pm UTC](https://discuss.elastic.co/t/logstash-split-function/233164/4 "2020-05-18T18:09:04Z")

</div>

> [@hariskhalique](#):
>
> Beige, Black, Blue, boohoo, Brown, cat:dresses, DZZ56895, Green, Grey, New Arrivals, Orange, Pink, Purple, Red, subcat:cocktail:cat:dresses, White, women, Yellow, z\_global\_id:39039

Once you split that you will have an array

```
["Beige", "Black", "Blue", "boohoo", "Brown", "cat:dresses", "DZZ56895", "Green", "Grey", "New Arrivals", "Orange", "Pink", "Purple", "Red", "subcat:cocktail:cat:dresses", "White", "women", "Yellow", "z_global_id:39039"]

```

Are you sure that you want to turn that into

```
["Beige", "Black", "Blue", "boohoo", "Brown", { "cat": "dresses"}, "DZZ56895", "Green", "Grey", "New Arrivals", "Orange", "Pink", "Purple", "Red", { "subcat": "cocktail:cat:dresses", "White", "women", "Yellow", {"z_global_id": "39039"}]

```

which is an array in which some entries are strings and some are hashes? I am uncertain that elasticsearch will even allow this (you may get a mapping exception), and doubt it will be useable in kibana.

You would have to write a ruby filter.

---

<div class="post-metadata">

**Author:** ![hariskhalique](https://avatars.discourse-cdn.com/v4/letter/h/a3d4f5/32.png) [@hariskhalique](https://discuss.elastic.co/u/hariskhalique)\
**Post date:** [May 18, 2020, 6:13pm UTC](https://discuss.elastic.co/t/logstash-split-function/233164/5 "2020-05-18T18:13:45Z")

</div>

I just want to get this

```
{ "cat": "dresses"}

```

out of the tags. As I am new I think we have split with "," first then look for hash and then split again with ":" and then create fields and value. Which I am not sure how I can do it in logstash configuration file.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 18, 2020, 7:38pm UTC](https://discuss.elastic.co/t/logstash-split-function/233164/6 "2020-05-18T19:38:16Z")

</div>

You will need to use ruby

```
    mutate { add_field => { "[@metadata][fields]" => "%{message}" } }
    mutate { split => { "[@metadata][fields]" => "," } }
    ruby {
        code => '
            event.get("[@metadata][fields]").each { |x|
                x = x.strip
                matches = x.match(/([^:]+):(.+)/)
                if matches
                    event.set(matches[1], matches[2])
                end
            }
        '
    }

```

will produce

```
        "cat" => "dresses",
"z_global_id" => "39039",
     "subcat" => "cocktail:cat:dresses"
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 15, 2020, 7:38pm UTC](https://discuss.elastic.co/t/logstash-split-function/233164/7 "2020-06-15T19:38:27Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.