# Problem with split add field

**URL:** https://discuss.elastic.co/t/problem-with-split-add-field/256018
**Category:** Logstash
**Created:** [November 19, 2020, 4:46pm UTC](https://discuss.elastic.co/t/problem-with-split-add-field/256018 "2020-11-19T16:46:44Z")
**Posts on this page:** 1
**Showing post:** 2

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [November 19, 2020, 4:57pm UTC](https://discuss.elastic.co/t/problem-with-split-add-field/256018/2 "2020-11-19T16:57:57Z")

</div>

A mutate filter does things in a [fixed order](https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-proc_order), and copy comes after split, so when split executes the [tmp\_message] field does not exist.

Break your mutate into two filters, with copy in the first and split and add\_field (which is done last) in the second. I would do it as

```
mutate {
    copy => { "cefmessage" => "[@metadata][cefmessage]" }
}
mutate {
    split => { "[@metadata][cefmessage]" => "|" }
    add_field => {
        "cef_device_vendor" => "%{[@metadata][cefmessage][1]}"
        "cef_device_product" => "%{[@metadata][cefmessage][3]}"
        "cef_device_version" => "%{[@metadata][cefmessage][4]}"
    }
}

```

Fields under [@metadata] are not indexed.

If you want to parse all of the CEF data then you may be able to do it using the [cef codec](https://discuss.elastic.co/t/filter-cef/181215/5).

---

_[View the full topic](https://discuss.elastic.co/t/problem-with-split-add-field/256018)._