# Only String and Array types are splittable

**URL:** <https://discuss.elastic.co/t/only-string-and-array-types-are-splittable/95246>\
**Category:** Logstash\
**Created:** [July 31, 2017, 9:09pm UTC](https://discuss.elastic.co/t/only-string-and-array-types-are-splittable/95246 "2017-07-31T21:09:48Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Callahan](https://avatars.discourse-cdn.com/v4/letter/c/dbc845/32.png) [@Callahan](https://discuss.elastic.co/u/Callahan)\
**Post date:** [July 31, 2017, 9:09pm UTC](https://discuss.elastic.co/t/only-string-and-array-types-are-splittable/95246/1 "2017-07-31T21:09:48Z")

</div>

Or more specifically:

`logstash.filters.split ] Only String and Array types are splittable. field:event_data.MemberName is of type = NilClass`

Hi,

So, I'd like to extract the contents of the string field called: field:event\_data.MemberName that is returned from a Winlogbeat.  
The string currently reads in the format of:

`CN=John Doe,OU=ACME,OU=Users,OU=8,OU=Paris,OU=FR,DC=mybigdomain,DC=com`

The goal is to create 3 new fields and extract the certain contents of the string to populate those fields.

The relevant snippet of code I am using (and failing with) is as follows below. As the comments in the code seem to cause the format to become corrupted in the post, a quick summary of what I'm trying to do is:

If the field named event\_data.MemberName isn't empty, mutate the event\_data.MemberName field (this is my attempt to rid myself of the failure shown at the top of this post.  
I'm then trying to split the field event\_data.MemberName into an array called dn.  
Then I want to reference the 3rd from last array member (in this case the country), and drop it into a new field called 'Country"

I'm just not sure where this is failing as the event\_data.MemberName is defined as a string in Kibana when examining the index itself and I'm force converting it to a string even if it's not within Logstash.

```
filter {
if 'dcs' in [tags] {
    		if ([event_data.MemberName] != "") {
    		
    		mutate {
		    convert => { "event_data.MemberName" => "string" }
    		}
    				
    		split{
    		field => "event_data.MemberName"
    		target => "dn"
    		terminator => ","
		    add_field => { "country" => "%{[dn][-3]}" }
			 
			}

```

Anything obvious I'm missing?

Thanks.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 2, 2017, 6:32pm UTC](https://discuss.elastic.co/t/only-string-and-array-types-are-splittable/95246/2 "2017-08-02T18:32:15Z")

</div>

> Only String and Array types are splittable. field:event\_data.MemberName is of type = NilClass

This typically indicates that you're trying to split a field that does exist.

> ```
> if ([event_data.MemberName] != "") {
> 
> ```

That's not the correct syntax for referencing nested fields; see [Accessing event data and fields | Logstash Reference [8.11] | Elastic](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#logstash-config-field-references).

---

<div class="post-metadata">

**Author:** ![Callahan](https://avatars.discourse-cdn.com/v4/letter/c/dbc845/32.png) [@Callahan](https://discuss.elastic.co/u/Callahan)\
**Post date:** [August 4, 2017, 11:26am UTC](https://discuss.elastic.co/t/only-string-and-array-types-are-splittable/95246/3 "2017-08-04T11:26:50Z")

</div>

Hi Magnus,

Thanks for the reply. I started down that path of referencing the field components but failed as I can't understand how to reference a specific field that has the same name as another element within it's parent.

For example, from the example docs:

```
{
  "agent": "Mozilla/5.0 (compatible; MSIE 9.0)",
  "ip": "192.168.24.44",
  "request": "/index.html"
  "response": {
    "status": 200,
    "bytes": 52353
  },
  "ua": {
    "os": "Windows 7"
  }
}

```

To reference the "os" field, you'd use [ua] [os]. This example expects each field to have a different name. So how would I use this process to reference something like this:

`CN=John Doe,OU=ACME,OU=Users,OU=8,OU=Paris,OU=FR,DC=mybigdomain,DC=com`

If I want to extract the country for example, how can I use event\_data.MemberName? - I'm thinking:

[event\_data.MemberName] [OU] or [event.data] [OU]

I don't see any way of targeting the specific OU that contains the country though.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [August 4, 2017, 11:36am UTC](https://discuss.elastic.co/t/only-string-and-array-types-are-splittable/95246/4 "2017-08-04T11:36:06Z")

</div>

Oh, I see what you're trying to do. The split filter doesn't do what you think it does. You can try using the mutate filter's split option which splits a string into an array (rather than splicing a single event into multiple events) but I don't know if negative array indexes work. Another option is using a grok filter.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 1, 2017, 11:36am UTC](https://discuss.elastic.co/t/only-string-and-array-types-are-splittable/95246/5 "2017-09-01T11:36:19Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.