# Process single data to apply multiple split and store as array **URL:** \ **Category:** Logstash\ **Created:** [June 23, 2020, 5:36am UTC](https://discuss.elastic.co/t/process-single-data-to-apply-multiple-split-and-store-as-array/238189 "2020-06-23T05:36:39Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![karthick2020](https://avatars.discourse-cdn.com/v4/letter/k/eb9ed0/32.png) [@karthick2020](https://discuss.elastic.co/u/karthick2020)\ **Post date:** [June 23, 2020, 5:36am UTC](https://discuss.elastic.co/t/process-single-data-to-apply-multiple-split-and-store-as-array/238189/1 "2020-06-23T05:36:39Z")
Hi Team, I am looking for clarifications on below **sample log:** 30338 /opt/IBM/WebSphere/AppServe 19.1 1.3~ 4609 /opt/BESClient/bin/BESClien 0.2 0.4~20235 /opt/IBM/WebSphere/AppServe 18.8 0.3~ 354 /opt/IBM/WebSphere/AppServe 11.2 0.1~ 5193 /opt/IBM/WebSphere/AppServe 2.9 0.1~23920 /opt/IBM/WebSphere/AppServe 4.3 0.1~30811 /opt/Tanium/TaniumClient/Ta 0.7 0.1 **grok filter:** %{GREEDYDATA:process} **my output:** "process": [ [ "30338 /opt/IBM/WebSphere/AppServe 19.1 1.3~ 4609 /opt/BESClient/bin/BESClien 0.2 0.4~20235 /opt/IBM/WebSphere/AppServe 18.8 0.3~ 354 /opt/IBM/WebSphere/AppServe 11.2 0.1~ 5193 /opt/IBM/WebSphere/AppServe 2.9 0.1~23920 /opt/IBM/WebSphere/AppServe 4.3 0.1~30811 /opt/Tanium/TaniumClient/Ta 0.7 0.1~ 1 init [3] 0.0 0.0~ 2 [migration/0] 0.0 0.0~ 3 [ksoftirqd/0] 0.0 0.0~ 4 [migration/1] 0.0 0.0~ 5 [ksoftirqd/1] 0.0 0.0~ 6 [events/0] 0.0 0.0~ 7 [events/1] 0.0 0.0~ 8 [khelper] 0.0 0.0" ] ] Now I want to apply multiple split **1st split using "~"** & write to array type field - "process\_tmp" mutate { copy =\> { "process" =\> "process\_tmp" } } mutate { split =\> { "process\_tmp" =\> "~ " } } sample output for process\_tmp field: 30338 /opt/IBM/WebSphere/AppServe 19.1 1.3,4609 /opt/BESClient/bin/BESClien 0.2 0.4 **2nd split using " "** (space) and store it to defined array for all entries. mutate { split =\> { "process\_tmp" =\> " " } add\_field =\> { "system\_proc\_pid" =\> "%{[process\_tmp][0]}" } add\_field =\> { "system\_proc\_name" =\> "%{[process\_tmp][1]}" } add\_field =\> { "system\_proc\_mem" =\> "%{[process\_tmp][2]}" } add\_field =\> { "system\_proc\_cpu" =\> "%{[process\_tmp][3]}" } } **expected final output:** system\_proc\_pid = 30338, 4609 system\_proc\_name = /opt/IBM/WebSphere/AppServe, /opt/BESClient/bin/BESClien system\_proc\_mem = 19.1, 0.2 system\_proc\_cpu = 1.3, 0.4 Is this feasible?. I tried above and get **actual output** as below system\_proc\_pid = 30338 /opt/IBM/WebSphere/AppServe 19.1 1.3 system\_proc\_name = 4609 /opt/BESClient/bin/BESClien 0.2 0.4 system\_proc\_mem = 20235 /opt/IBM/WebSphere/AppServe 18.8 0.3 system\_proc\_cpu = 354 /opt/IBM/WebSphere/AppServe 11.2 0.1 ---
**Author:** ![karthick2020](https://avatars.discourse-cdn.com/v4/letter/k/eb9ed0/32.png) [@karthick2020](https://discuss.elastic.co/u/karthick2020)\ **Post date:** [June 25, 2020, 4:28pm UTC](https://discuss.elastic.co/t/process-single-data-to-apply-multiple-split-and-store-as-array/238189/2 "2020-06-25T16:28:24Z")
Hi Team, Please ignore this. I have found solution and implemented for my project. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 23, 2020, 4:28pm UTC](https://discuss.elastic.co/t/process-single-data-to-apply-multiple-split-and-store-as-array/238189/3 "2020-07-23T16:28:31Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.