", ""] }
```
---
### Author:  [@Imad\_Bouchakour](https://discuss.elastic.co/u/Imad_Bouchakour)
#### Post date: [July 30, 2019, 12:56pm UTC](https://discuss.elastic.co/t/logstash-xml/192452/7 "2019-07-30T12:56:48Z")
thanks i fix it.
---
### Author:  [@Imad\_Bouchakour](https://discuss.elastic.co/u/Imad_Bouchakour)
#### Post date: [July 30, 2019, 3:16pm UTC](https://discuss.elastic.co/t/logstash-xml/192452/8 "2019-07-30T15:16:20Z")
Another question: i'am ussing logstash 7.2.0 in my test environment and it work bu in another one there is logstash 6.0.1 and that doesn't work it, is it normal ?
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 30, 2019, 3:41pm UTC](https://discuss.elastic.co/t/logstash-xml/192452/9 "2019-07-30T15:41:50Z")
I would expect the same configuration to work. What does not work?
---
### Author:  [@Imad\_Bouchakour](https://discuss.elastic.co/u/Imad_Bouchakour)
#### Post date: [July 31, 2019, 1:52pm UTC](https://discuss.elastic.co/t/logstash-xml/192452/10 "2019-07-31T13:52:57Z")
log stash bloc completely, and i don't have any log and reset log config don't work. it not problem i'am sending the data to elasticsearch from another environment.
i have this :
status online 282673s
i want to split the "online 282673s" i tried split =\> { "status" =\> " " } but that doesn't work how to slip with space ??
---
### Author:  [@Imad\_Bouchakour](https://discuss.elastic.co/u/Imad_Bouchakour)
#### Post date: [August 1, 2019, 1:40pm UTC](https://discuss.elastic.co/t/logstash-xml/192452/11 "2019-08-01T13:40:14Z")
this is what i did and that doesn't work
```
gsub => ["status", " ", ":"]
split => { "status" => ":" }
add_field => {
"firstPart" => "%{[status][0]}"
"secondPart" => "%{[status][1]}"
}
```
this is what i'am getting
secondPart: %{[status][1]}
firstPart: online:5039s
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [August 1, 2019, 2:01pm UTC](https://discuss.elastic.co/t/logstash-xml/192452/12 "2019-08-01T14:01:45Z")
I cannot explain why that would not work. With this configuration
```
filter {
mutate { add_field => { "status" => "online 282673s" } }
mutate {
split => { "status" => " " }
add_field => {
"firstPart" => "%{[status][0]}"
"secondPart" => "%{[status][1]}"
}
}
}
```
or this configuration
```
input { generator { count => 1 lines => [''] } }
filter {
mutate { add_field => { "status" => "online 282673s" } }
mutate {
gsub => ["status", " ", ":"]
split => { "status" => ":" }
add_field => {
"firstPart" => "%{[status][0]}"
"secondPart" => "%{[status][1]}"
}
}
}
```
I get
```
"firstPart" => "online",
"secondPart" => "282673s",
"status" => [
[0] "online",
[1] "282673s"
],
```
---
### Author:  [@Imad\_Bouchakour](https://discuss.elastic.co/u/Imad_Bouchakour)
#### Post date: [August 1, 2019, 2:51pm UTC](https://discuss.elastic.co/t/logstash-xml/192452/13 "2019-08-01T14:51:43Z")
That didn't work with my field, don't now why. so this is what i did and it work
```
mutate { add_field => { "statusbis" => "%{[status]}" } }
mutate {
split => { "statusbis" => " " }
add_field => {
"firstPart" => "%{[statusbis][0]}"
"secondPart" => "%{[statusbis][1]}"
}
}
```
And it works tanks for your help
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [August 1, 2019, 3:44pm UTC](https://discuss.elastic.co/t/logstash-xml/192452/14 "2019-08-01T15:44:13Z")
All of that would be consistent with the original status field being an array with a single member.
```
"status" => [
[0] "online:282673s"
],
```
That would explain why the original mutates did nothing and why it started working when you copied status to another field (which is not an array).
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 29, 2019, 3:44pm UTC](https://discuss.elastic.co/t/logstash-xml/192452/15 "2019-08-29T15:44:15Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.