# Parsing field to multiple fields and inserting into another field

**URL:** <https://discuss.elastic.co/t/parsing-field-to-multiple-fields-and-inserting-into-another-field/106200>\
**Category:** Logstash\
**Created:** [November 2, 2017, 1:01pm UTC](https://discuss.elastic.co/t/parsing-field-to-multiple-fields-and-inserting-into-another-field/106200 "2017-11-02T13:01:19Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![GambitK](https://avatars.discourse-cdn.com/v4/letter/g/47e85d/32.png) [@GambitK](https://discuss.elastic.co/u/GambitK)\
**Post date:** [November 2, 2017, 1:01pm UTC](https://discuss.elastic.co/t/parsing-field-to-multiple-fields-and-inserting-into-another-field/106200/1 "2017-11-02T13:01:19Z")

</div>

I have two fields I want to modify, sql\_bind and sql\_text. The fields contain sql statement from oracle logs:

> "sql\_bind":" #1(8):25793401"  
> "sql\_text":"delete from table01 where num01 = :b1"
> 
> "sql\_bind":" #1(8):24834401 #2(5):63877"  
> "sql\_text":"delete from table01 where num01 = :b1 and num02 = :b2 "
> 
> "sql\_bind":" #1(8):24834401 #2(5):64267 #3(7):dataxyz"  
> "sql\_text":"delete from table01 where num01 = :b1 and num02 = :b2 and text01 = :b3"

I want to extract the variables from sql\_bind and create new fields based on their values. The problem is that beforehand you can't know how many fiels you will have to extract.

After that I would like to reconstruct the sql\_text into a whole statement replacing the variable name with the corresponding value taken from sql\_bind.

I've tried with a mutate filter but since the splitting string is at the start of each value, I get one empty field in the array:

> ```
> mutate {
> split => { "sql_bind" => " #" }
> }
> 
> ```

Results in:

> ```
> "sql_bind" => [
> [0] "",
> [1] "1(8):24834401"
> [2] "2(5):63877"
> ]
> 
> ```

Even after solving that, I have the problem of reinserting the values into sql\_text.  
Any help would be appreciated.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 30, 2017, 1:01pm UTC](https://discuss.elastic.co/t/parsing-field-to-multiple-fields-and-inserting-into-another-field/106200/2 "2017-11-30T13:01:23Z")

</div>

Closed on November 30, 2017, 1:01pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.