# Saving a string from an array of strings as a field

**URL:** https://discuss.elastic.co/t/saving-a-string-from-an-array-of-strings-as-a-field/114915
**Category:** Logstash
**Created:** [January 10, 2018, 4:27pm UTC](https://discuss.elastic.co/t/saving-a-string-from-an-array-of-strings-as-a-field/114915 "2018-01-10T16:27:42Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![rjm61](https://avatars.discourse-cdn.com/v4/letter/r/b9e5f3/32.png) [@rjm61](https://discuss.elastic.co/u/rjm61)
#### Post date: [January 10, 2018, 4:27pm UTC](https://discuss.elastic.co/t/saving-a-string-from-an-array-of-strings-as-a-field/114915/1 "2018-01-10T16:27:43Z")

</div>

I am using a kv filter to split an event message of comma separated values on the coma character to create a string array fa and saving a specific array element as a field as follows

```auto
filter {
  kv { # Split comma separated data into an array (fa). 
     field_split => ","
     source => "message"
     target => "fa"
  }
  mutate {
     add_field => { "server-name" => "%{fa[3]}" }
  }
  ...  
}

```

This always generates the litteral text "%{fa[3]}" as the server-name field value rather than the contents 4th element in the fa array. Please can someone tell me what I am doing wrong?

Later on in an output filter I can embed "%{fa[3]}" in a string to export the same array element to a file using the sprintf forma.. Please can someone tell me what am I missing above?  
Logstash version = 5.2.2

---

<div class="post-metadata">

### Author: ![guyboertje](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/guyboertje/32/31592_2.png) [@guyboertje](https://discuss.elastic.co/u/guyboertje)
#### Post date: [January 11, 2018, 11:47am UTC](https://discuss.elastic.co/t/saving-a-string-from-an-array-of-strings-as-a-field/114915/2 "2018-01-11T11:47:39Z")

</div>

The KV filter does not work as you expect.

**What does your message line look like?**

Testing...  
Config:

```auto
input {
  generator {
    message => "a=foo,b=bar,c=baz"
    count => 1
  }
}

filter {
  kv { # Split comma separated data into an array (fa).
     field_split => ","
     source => "message"
     target => "fa"
  }
  mutate {
     add_field => { "server-name" => "%{fa[3]}" }
     add_field => { "success" => "%{[fa][b]}" }
  }
}

output {
  stdout {
    codec => rubydebug {metadata => true}
  }
}

```

Result:

```auto
{
    "server-name" => "%{fa[3]}",
       "sequence" => 0,
     "@timestamp" => 2018-01-11T11:45:17.575Z,
        "success" => "bar",
       "@version" => "1",
           "host" => "Elastics-MacBook-Pro.local",
             "fa" => {
        "a" => "foo",
        "b" => "bar",
        "c" => "baz"
    },
        "message" => "a=foo,b=bar,c=baz"
}

```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 8, 2018, 11:47am UTC](https://discuss.elastic.co/t/saving-a-string-from-an-array-of-strings-as-a-field/114915/3 "2018-02-08T11:47:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.