# Regarding Split filter in mutate

**URL:** https://discuss.elastic.co/t/regarding-split-filter-in-mutate/308540
**Category:** Logstash
**Created:** [June 30, 2022, 7:25am UTC](https://discuss.elastic.co/t/regarding-split-filter-in-mutate/308540 "2022-06-30T07:25:43Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![suresh\_u](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/suresh_u/32/107394_2.png) [@suresh\_u](https://discuss.elastic.co/u/suresh_u)
#### Post date: [June 30, 2022, 7:25am UTC](https://discuss.elastic.co/t/regarding-split-filter-in-mutate/308540/1 "2022-06-30T07:25:43Z")

</div>

Hi team,  
I have one roll number like 1071-P56790-345.

First number is 1071. Remaining fields in future can be added.  
So I need to extract **1071 and P56790-345** into 2 seperate fields.

I tried using filter by delimeter '-'. But array is in the record. Below is the syntax:

mutate {  
split =\> { "doc\_number" =\> "-" }   
}

Could someone please suggest how to solve it?

Thanks.

---

<div class="post-metadata">

### Author: ![sudhagar\_ramesh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sudhagar_ramesh/32/105673_2.png) [@sudhagar\_ramesh](https://discuss.elastic.co/u/sudhagar_ramesh)
#### Post date: [June 30, 2022, 7:40am UTC](https://discuss.elastic.co/t/regarding-split-filter-in-mutate/308540/2 "2022-06-30T07:40:24Z")

</div>

Hello @suresh_u

You can use grok filter to make it has two separate fields

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/b/c/bcea899e36b249935dda736ed99746468c2ec272.png)

```auto
filter
{
grok
{
match => {"message" => ["doc_number", "%{DATA:firstnumber}-%{GREEDYDATA:lastnumber}"]}
}
}

```

---

<div class="post-metadata">

### Author: ![suresh\_u](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/suresh_u/32/107394_2.png) [@suresh\_u](https://discuss.elastic.co/u/suresh_u)
#### Post date: [June 30, 2022, 7:52am UTC](https://discuss.elastic.co/t/regarding-split-filter-in-mutate/308540/3 "2022-06-30T07:52:17Z")

</div>

thanks @sudhagar_ramesh let me try.

---

<div class="post-metadata">

### Author: ![suresh\_u](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/suresh_u/32/107394_2.png) [@suresh\_u](https://discuss.elastic.co/u/suresh_u)
#### Post date: [June 30, 2022, 8:29am UTC](https://discuss.elastic.co/t/regarding-split-filter-in-mutate/308540/4 "2022-06-30T08:29:07Z")

</div>

Thanks a lot @sudhagar_ramesh . It is working.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 28, 2022, 8:29am UTC](https://discuss.elastic.co/t/regarding-split-filter-in-mutate/308540/5 "2022-07-28T08:29:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.