# Only String and Array types are splittable. field:\[field\]\[Name\] is of type = Hash
**URL:** https://discuss.elastic.co/t/only-string-and-array-types-are-splittable-field-field-name-is-of-type-hash/73252
**Category:** Logstash
**Created:** [January 30, 2017, 5:23pm UTC](https://discuss.elastic.co/t/only-string-and-array-types-are-splittable-field-field-name-is-of-type-hash/73252 "2017-01-30T17:23:12Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@graham.dalessandro](https://discuss.elastic.co/u/graham.dalessandro)
#### Post date: [January 30, 2017, 5:23pm UTC](https://discuss.elastic.co/t/only-string-and-array-types-are-splittable-field-field-name-is-of-type-hash/73252/1 "2017-01-30T17:23:12Z")
Hello,
I just upgraded from LS 2.4 to 5.1.2 and i am having an issue with splitting values using the "split" filter. This exact configuration works in 2.4 without any issue but i am unable to get past the error in 5.1.2. Info below:
Data string: This has been broken out for readability. If the raw string is needed i have placed it at the bottom.
{"businessTransactions":{"occurrences":[{
"convertedBy":[]
"responseTime":8828.0
"values":[0.5]
"execTime":10994.09271658212
"clientErrors":0
"failed":false
"purePathId":"PT=306870;PA=865520890;PS=-663098133"
"clientTime":7929.140161869714
"url":"[https://test.com.com](https://test.com.com)"
"processingTime":5605
"networkTime":12.827512862494451
"duration":8828.0
"visitId":234294
"cpuTime":88.64864340622293
"dnsTime":0
"connectTime":0
"documentRequestTime":1
"documentResponseTime":1
"startTime":1485796352354
"serverTime":886.0323252677917
"dimensions":["tolerating"
"10.0.0.0"
"Desktop Browser"
"Windows"
"IE"]
"actionName":"_load_"}
{"convertedBy":[]
"responseTime":570.0
"values":[1.0]
"execTime":1209.8055751509964
"clientErrors":0
"failed":false
"purePathId":"PT=306871;PA=765838904;PS=-663098133"
"clientTime":281.36721664000714
"url":"[https://test.com.com](https://test.com.com)"
"networkTime":1.1624016232374834
"duration":570.0
"visitId":234294
"cpuTime":29.263739234767854
"startTime":1485796365718
"serverTime":287.47038173675537
"dimensions":["satisfied"
"10.0.0.0"
"Desktop Browser"
"Windows"
"IE"]
"actionName":"keypress on "searchBox""}
{"convertedBy":[]
"responseTime":5107.0
"values":[0.5]
"execTime":11648.502552277409
"clientErrors":0
"failed":false
"purePathId":"PT=306884;PA=-1990575953;PS=-663098133"
"clientTime":3574.5189283634018
"url":"[https://test.com.com](https://test.com.com)"
"networkTime":21.251010820786956
"duration":5107.0
"visitId":234294
"cpuTime":491.311846148298
"startTime":1485796374089
"serverTime":1511.2300608158112
"dimensions":["tolerating"
"10.0.0.0"
"Desktop Browser"
"Windows"
"IE"]
"actionName":"click on "Continue""}]
"application":"Client Center"
"dimensionNames":["Apdex performance zone for User Actions"
"Visits - IP Address"
"Client Type of Visits"
"Operating System of Visits"
"Client Family of Visits"]
"systemProfile":"RJ"
"name":"EXPORT\_User Actions"
"measureNames":["Apdex of User Actions"]
"type":1}
"@timestamp":"2017-01-30T17:13:29.726Z"
"@version":"1"
"serverName":"[dtServer.com.com](http://dtServer.com.com)"
"tags":["splitted\_bts"]}
The config setting:
split {
field =\> "[businessTransactions][occurrences]"
}
The error:
Only String and Array types are splittable. field:[businessTransactions][occurrences] is of type = Hash
---
### Author:  [@graham.dalessandro](https://discuss.elastic.co/u/graham.dalessandro)
#### Post date: [January 30, 2017, 5:23pm UTC](https://discuss.elastic.co/t/only-string-and-array-types-are-splittable-field-field-name-is-of-type-hash/73252/2 "2017-01-30T17:23:58Z")
Full config:
input {
```
# 1st pass listener: interpreter for Dynatrace's protobuf message. input from dtamx01aplqa
http {
threads => 8
port => 8080
codec => protobuf {
class_name => "Export::Bt::BusinessTransactions"
include_path => ['/app/etc/logstash/conf/dt_bt_export-6.3.5.rb']
}#end codec
}
# 2nd pass listener: read split messages for transforming/enhancing
http {
threads => 8
port => 8081
codec => "json"
tags => "stage2"
}
```
} #end input
filter {
# Stage 1
# we don't need host and headers
mutate {
remove\_field =\> ["headers", "host"]
}
```
# check if this is a batch message from dynatrace containing multiple businesstransactions
# if yes split by BT and add a tag so we can identify it in the next pass
if ("splitted_bts" not in [tags]) {
json {
source => "message"
}
split {
field => "businessTransactions"
add_tag => ["splitted_bts"]
}
}
# if message has been already split by BTs, split again by every occurence of the BT
#if ( "splitted_bts" in [tags] and [businessTransactions][occurrences]) {
split {
field => "[businessTransactions][occurrences]"
}
}
# Stage 2: this is the stage where every BT and every BT occurence has been split already and has been looped back into logstash
# now it's time for processing the single event. The first IF statement will check that a responseTime has been given, if it has not then the event is ignored.
```
}#end filter
output {
#if businesstransactions field exists we are in pass 1, have splitted and loop it back for further processing
#if [businessTransactions] {
# http {
# http\_method =\> "post"
# url =\> "[http://stash01aplqa.rjf.com:8081](http://stash01aplqa.rjf.com:8081)"
# }#end http
file {
path =\> "/var/log/logstash/dynatraceQA-Pre-Filter-TEST%{+YYYY-MM-dd}.txt"
}#end file
```
#}#end if
# second pass, processing and enhancing has been done, write out
#else if ([businesstransaction] != "%{[businessTransactions][name]}") {
# redis {
# host => "10.97.0.150"
# port => 6379
# data_type => "list"
# key => "logstash:redis"
# codec => "rubydebug"
# }#end redis
#}#end else
```
}#end output
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 27, 2017, 5:24pm UTC](https://discuss.elastic.co/t/only-string-and-array-types-are-splittable-field-field-name-is-of-type-hash/73252/3 "2017-02-27T17:24:04Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.