# Need to split a field into several fields in a JSON object

**URL:** <https://discuss.elastic.co/t/need-to-split-a-field-into-several-fields-in-a-json-object/71418>\
**Category:** Logstash\
**Created:** [January 12, 2017, 5:55pm UTC](https://discuss.elastic.co/t/need-to-split-a-field-into-several-fields-in-a-json-object/71418 "2017-01-12T17:55:17Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Lahiru\_Lakshitha\_Sam](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lahiru_lakshitha_sam/32/14521_2.png) [@Lahiru\_Lakshitha\_Sam](https://discuss.elastic.co/u/Lahiru_Lakshitha_Sam)\
**Post date:** [January 12, 2017, 5:55pm UTC](https://discuss.elastic.co/t/need-to-split-a-field-into-several-fields-in-a-json-object/71418/1 "2017-01-12T17:55:17Z")

</div>

I need to split the "message": in to several fields in the same event and to remove some stuff in the "message": field Can I do this using split or mutate Need some help?

- Version: Logstash 5.1.1
- Operating System: CentOS
- Config File: Still I am developing to my requirements

-SampleData: {  
"\_index": "vdashboard",  
"\_type": "vdash\_events",  
"\_id": "AVmTpJUfTdL92-F20ysP",  
"\_score": null,  
"\_source": {  
"@timestamp": "2017-01-12T17:05:53.941Z",  
"port": 48169,  
"@version": "1",  
"host": "10.25.7.242",  
"message": "{"status": "new", "storedTimestamp": "2017-01-12T17:05:11+0000", "domain": "IPM", "description": "TEST - Metric Memory Usage = 20%", "producer": "collector.vcenter.events", "locationCoordinates": [0, 0], "monitoredCIName": "node2", "source\_events\_count": 1, "assigned\_to\_name": "", "\_id": "6f4659878eada113668aac28a7819cf7", "date\_raised": "2017-01-12", "platforms": [""], "assigned\_to\_id": "", "raisedLocalTimestamp": "2017-01-12T17:05:11+0000", "toolUUID": "", "timestamp\_reset": "", "detailsURL": "", "locationLabel": "", "message": "{'SNMP-COMMUNITY-MIB::snmpTrapAddress': '\\n\\x19\\t\\xe6', 'VMWARE-VC-EVENT-MIB::vmwVpxdTargetObjType': '3', 'VMWARE-VC-EVENT-MIB::vmwVpxdObjValue': 'TEST - Metric Memory Usage = 20%', 'SNMP-COMMUNITY-MIB::snmpTrapCommunity': '', 'VMWARE-VC-EVENT-MIB::vmwVpxdTargetObj': 'node2', 'VMWARE-VC-EVENT-MIB::vmwVpxdOldStatus': 'Yellow', 'VMWARE-VC-EVENT-MIB::vmwVpxdNewStatus': 'Red', 'SNMPv2-MIB::snmpTrapEnterprise': '1.3.6.1.4.1.6876.4.3', 'SNMPv2-MIB::sysUpTime': '415675122'}", "monitoredCIID": "", "date\_hour\_ended": "2017-01-12T17:05:11+0000", "locationCode": "LO1", "objectType": "event", "category": "Host", "version": "0.1.9", "state\_trigger\_id": "203", "isResetEvent": 0, "severity": 4, "objectId": "", "title": "TEST - node2", "monitoredCIClass": "", "related\_events\_ids": [""], "incident\_number": "", "trigger": "TEST - node2", "products": ["Vcenter\_Events"], "extraSourceData": {}, "KBArticle": "", "related\_states\_ids": [""], "timestamp\_updated": "2017-01-12T17:05:11+0000", "raisedTimestamp": "2017-01-12T17:05:11+0000"}",  
"type": "vdash\_events",  
"tags": []  
},  
"fields": {  
"@timestamp": [  
1484240753941  
]  
},  
"sort": [  
1484240753941  
]  
}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [January 12, 2017, 6:29pm UTC](https://discuss.elastic.co/t/need-to-split-a-field-into-several-fields-in-a-json-object/71418/2 "2017-01-12T18:29:05Z")

</div>

It looks like you should specify `codec => json` or possibly `codec => json_lines` in your input plugin. If that for some reason isn't possible you should use the json filter.

---

<div class="post-metadata">

**Author:** ![Lahiru\_Lakshitha\_Sam](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lahiru_lakshitha_sam/32/14521_2.png) [@Lahiru\_Lakshitha\_Sam](https://discuss.elastic.co/u/Lahiru_Lakshitha_Sam)\
**Post date:** [January 12, 2017, 6:39pm UTC](https://discuss.elastic.co/t/need-to-split-a-field-into-several-fields-in-a-json-object/71418/3 "2017-01-12T18:39:19Z")

</div>

Thanks I'm still new to ELK stack I'll try that

---

<div class="post-metadata">

**Author:** ![Lahiru\_Lakshitha\_Sam](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lahiru_lakshitha_sam/32/14521_2.png) [@Lahiru\_Lakshitha\_Sam](https://discuss.elastic.co/u/Lahiru_Lakshitha_Sam)\
**Post date:** [January 12, 2017, 10:32pm UTC](https://discuss.elastic.co/t/need-to-split-a-field-into-several-fields-in-a-json-object/71418/4 "2017-01-12T22:32:19Z")

</div>

Thanks worked for me 🕶

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 9, 2017, 10:32pm UTC](https://discuss.elastic.co/t/need-to-split-a-field-into-several-fields-in-a-json-object/71418/5 "2017-02-09T22:32:37Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.