# Problem with split add field
**URL:** https://discuss.elastic.co/t/problem-with-split-add-field/256018
**Category:** Logstash
**Created:** [November 19, 2020, 4:46pm UTC](https://discuss.elastic.co/t/problem-with-split-add-field/256018 "2020-11-19T16:46:44Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@gius78](https://discuss.elastic.co/u/gius78)
#### Post date: [November 19, 2020, 4:46pm UTC](https://discuss.elastic.co/t/problem-with-split-add-field/256018/1 "2020-11-19T16:46:44Z")
Hello,
I am using logstash 7.6.2
I am trying to parse a CEF log, separated by pipes "|"
I've done:
```
mutate {
copy => { "cefmessage" => "tmp_message" }
split => { "tmp_message" => "|" }
add_field => { "cef_device_vendor" => "%{[tmp_message][1]}" }
add_field => { "cef_device_product" => "%{[tmp_message][3]}" }
add_field => { "cef_device_version" => "%{[tmp_message][4]}" }
}
```
I'v tried either split =\> {"tmp\_message" =\> "|"} and also the split =\> ["tmp\_message" , "|"]
syntax, both give no error in the system logs but I dunno if it's working.
I've read on other similar topics I had to use "%{[tmp\_message][1]}" instead of "%tmp\_message[1]}" .
The problem is that I simple get fields with literally the string : %{[tmp\_message][1]}
and NOT the content of [tmp\_message][1]
I've tried without double quotes and got an error. With single quotes is the same.
I am going crazy! I am sure the solution is very simple...
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [November 19, 2020, 4:57pm UTC](https://discuss.elastic.co/t/problem-with-split-add-field/256018/2 "2020-11-19T16:57:57Z")
A mutate filter does things in a [fixed order](https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-proc_order), and copy comes after split, so when split executes the [tmp\_message] field does not exist.
Break your mutate into two filters, with copy in the first and split and add\_field (which is done last) in the second. I would do it as
```
mutate {
copy => { "cefmessage" => "[@metadata][cefmessage]" }
}
mutate {
split => { "[@metadata][cefmessage]" => "|" }
add_field => {
"cef_device_vendor" => "%{[@metadata][cefmessage][1]}"
"cef_device_product" => "%{[@metadata][cefmessage][3]}"
"cef_device_version" => "%{[@metadata][cefmessage][4]}"
}
}
```
Fields under [@metadata] are not indexed.
If you want to parse all of the CEF data then you may be able to do it using the [cef codec](https://discuss.elastic.co/t/filter-cef/181215/5).
---
### Author:  [@gius78](https://discuss.elastic.co/u/gius78)
#### Post date: [November 19, 2020, 5:17pm UTC](https://discuss.elastic.co/t/problem-with-split-add-field/256018/3 "2020-11-19T17:17:15Z")
thanks A LOT.
It was simple, but i'd never get to this solution alone.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 17, 2020, 5:17pm UTC](https://discuss.elastic.co/t/problem-with-split-add-field/256018/4 "2020-12-17T17:17:41Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.