# Multisplit
**URL:** https://discuss.elastic.co/t/multisplit/129793
**Category:** Logstash
**Created:** [April 27, 2018, 9:18am UTC](https://discuss.elastic.co/t/multisplit/129793 "2018-04-27T09:18:06Z")
**Posts on this page:** 17
**Page:** 1
### Author:  [@laurentbillon](https://discuss.elastic.co/u/laurentbillon)
#### Post date: [April 27, 2018, 9:18am UTC](https://discuss.elastic.co/t/multisplit/129793/1 "2018-04-27T09:18:06Z")
Good afternoon,
I have log with : and - for separate information.
I want to select information between : and -
I try with ruby
> ruby {
> code =\> "event.set('source', event.get('origine').split(':')[1])";
> event.set('INFO', event.get('origine').split('\W+/')[1]);
> "
> }
and I try with a script field
> def test0 = /^.\*.(-?+)$/.matcher(doc['source'].value);
if ( test0.matches() ) {
return test0.group(0)
} else {
return "no"
}
But nothing is good.
Thank's for your help.
---
### Author:  [@Jenni](https://discuss.elastic.co/u/Jenni)
#### Post date: [April 27, 2018, 10:02am UTC](https://discuss.elastic.co/t/multisplit/129793/2 "2018-04-27T10:02:46Z")
Could you give an example for the value of origine and the text you'd like to extract from it?
I think a grok with a pattern like `%{GREEDYDATA:firstpart}:%{GREEDYDATA:secondpart}-%{GREEDYDATA:thirdpart}` (But ideally more specific patterns than GREEDYDATA) should do it.
---
### Author:  [@laurentbillon](https://discuss.elastic.co/u/laurentbillon)
#### Post date: [April 27, 2018, 10:09am UTC](https://discuss.elastic.co/t/multisplit/129793/3 "2018-04-27T10:09:57Z")
ID: TOTO - HOME - ROOM DIALED\_DIGITS: 22
---
### Author:  [@Jenni](https://discuss.elastic.co/u/Jenni)
#### Post date: [April 27, 2018, 10:34am UTC](https://discuss.elastic.co/t/multisplit/129793/4 "2018-04-27T10:34:15Z")
And what should the event fields extracted from that look like?
---
### Author:  [@laurentbillon](https://discuss.elastic.co/u/laurentbillon)
#### Post date: [April 27, 2018, 10:50am UTC](https://discuss.elastic.co/t/multisplit/129793/5 "2018-04-27T10:50:06Z")
I would like extract TOTO
---
### Author:  [@Jenni](https://discuss.elastic.co/u/Jenni)
#### Post date: [April 27, 2018, 10:55am UTC](https://discuss.elastic.co/t/multisplit/129793/6 "2018-04-27T10:55:11Z")
`:\s?(?[^-]*[^\s])\s?-` would work.
---
### Author:  [@laurentbillon](https://discuss.elastic.co/u/laurentbillon)
#### Post date: [April 27, 2018, 10:56am UTC](https://discuss.elastic.co/t/multisplit/129793/7 "2018-04-27T10:56:47Z")
on regex ruby or with grok ?
---
### Author:  [@Jenni](https://discuss.elastic.co/u/Jenni)
#### Post date: [April 27, 2018, 11:00am UTC](https://discuss.elastic.co/t/multisplit/129793/8 "2018-04-27T11:00:14Z")
That should actually work for both as it's just normal regular expression, I guess.
---
### Author:  [@laurentbillon](https://discuss.elastic.co/u/laurentbillon)
#### Post date: [April 27, 2018, 11:20am UTC](https://discuss.elastic.co/t/multisplit/129793/9 "2018-04-27T11:20:00Z")
Sorry but I try
> ruby {
> code =\> "event.set('source', event.get('origine').split(':')[1])";
> event.set('INFO', event.get('origine').split(':\s?[^-]\*[^\s])\s?-);
> "
> }
And I search when use
mutate filter
ruby
script field
Thank's for your help
---
### Author:  [@laurentbillon](https://discuss.elastic.co/u/laurentbillon)
#### Post date: [April 27, 2018, 12:46pm UTC](https://discuss.elastic.co/t/multisplit/129793/10 "2018-04-27T12:46:41Z")
It 's possible a solution with
> ruby {
> code =\> "
> info = event.get['origine'].split(':')
> ['source'] = info[1]
> info.each\_index { |i| event[i.to\_s] = info[i]
> country = info[1].split('-')
> event.set['Country'] = country[0]
> "
---
### Author:  [@laurentbillon](https://discuss.elastic.co/u/laurentbillon)
#### Post date: [April 27, 2018, 1:16pm UTC](https://discuss.elastic.co/t/multisplit/129793/11 "2018-04-27T13:16:23Z")
> ruby {
> code =\> "
> info = event.get('origine').split(':')[1]
> event.set('source', info)
> country = event(info).split('-')[0]
> event.set('Country', country)
> "
> }
I have an issue for split a second time
---
### Author:  [@laurentbillon](https://discuss.elastic.co/u/laurentbillon)
#### Post date: [April 27, 2018, 2:05pm UTC](https://discuss.elastic.co/t/multisplit/129793/12 "2018-04-27T14:05:55Z")
I try a regex ruby \W for all metacharacter.
but when I try
ruby {
code =\> "
info = event.get('origine').split(':')[1]
event.set('source', info)
country = event.get('origine').split('\W')[1]
event.set('Countrysorigne', coutry)
"
}
I have no error and I have same message origine and Coutryorigine
>
---
### Author:  [@laurentbillon](https://discuss.elastic.co/u/laurentbillon)
#### Post date: [April 30, 2018, 8:30am UTC](https://discuss.elastic.co/t/multisplit/129793/13 "2018-04-30T08:30:03Z")
Hello,
How I use :\s?(?[^-]\*[^\s])\s?-
I try
> event.get('origine).split(:\s?(?[^-]\*[^\s])\s?-)
> event.set('Origine1',info)
But I have an issue :
"Could not execute action: LogStash::PipelineAction::Create/pipeline\_id:main, action\_result: false", :backtrace=\>nil}
---
### Author:  [@Jenni](https://discuss.elastic.co/u/Jenni)
#### Post date: [April 30, 2018, 9:28am UTC](https://discuss.elastic.co/t/multisplit/129793/14 "2018-04-30T09:28:09Z")
If you are referring to my regex: That wasn't meant to be used as a separator for a split, but as an expression for grok or a ruby match function to directly extract TOTO into a field called yourinfo.
(And the code you posted is missing one ' as well was the // around the regex. That's probably why it is not only not working, but throwing an error.)
---
### Author:  [@laurentbillon](https://discuss.elastic.co/u/laurentbillon)
#### Post date: [April 30, 2018, 11:37am UTC](https://discuss.elastic.co/t/multisplit/129793/15 "2018-04-30T11:37:17Z")
Solution is similar to ?
> country = match(//:\s?(?[^-]\*[^\s])\s?-)//)
It's possible to send me an example for use a a param for write result.
Thank you
---
### Author:  [@Jenni](https://discuss.elastic.co/u/Jenni)
#### Post date: [April 30, 2018, 12:19pm UTC](https://discuss.elastic.co/t/multisplit/129793/16 "2018-04-30T12:19:31Z")
Ruby:
```
if result = event.get("origine").match(/:\s?(?[^-]*[^\s])\s?-/)
event.set("thatswhatyouwantedtoextract", result[:yourinfo])
end
```
Grok:
```
grok {
match => { "message" => ":\s?(?[^-]*[^\s])\s?-" }
}
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 28, 2018, 12:26pm UTC](https://discuss.elastic.co/t/multisplit/129793/17 "2018-05-28T12:26:06Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.