# Seperate dynamic comma seperated field into multiple fields

**URL:** https://discuss.elastic.co/t/seperate-dynamic-comma-seperated-field-into-multiple-fields/241103
**Category:** Logstash
**Created:** [July 14, 2020, 9:35am UTC](https://discuss.elastic.co/t/seperate-dynamic-comma-seperated-field-into-multiple-fields/241103 "2020-07-14T09:35:53Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![sz5ps5](https://avatars.discourse-cdn.com/v4/letter/s/779978/32.png) [@sz5ps5](https://discuss.elastic.co/u/sz5ps5)
#### Post date: [July 14, 2020, 9:35am UTC](https://discuss.elastic.co/t/seperate-dynamic-comma-seperated-field-into-multiple-fields/241103/1 "2020-07-14T09:35:54Z")

</div>

Apologies I am new to ELK and Logstash so this may be a simple solution.  
I have a field that is currently in the elk stack, it is passing through Logstash. The field is dynamic in that is can have any number of values. The values are text that are comma separated. I need the field to be split, with the values being passed new fields  
example input field: [server1, server2, server3, server4]

output needed: [server1field] = server1  
[server2field] = server1  
[server3field] = server1  
[server4field] = server1  
Any help is appreciated

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 14, 2020, 4:30pm UTC](https://discuss.elastic.co/t/seperate-dynamic-comma-seperated-field-into-multiple-fields/241103/2 "2020-07-14T16:30:18Z")

</div>

Use mutate+split to convert a string to an array. If you need to clean up whitespace you could use mutate+gsub before splitting the string or a ruby filter that calls the ruby String strip function after.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 11, 2020, 4:30pm UTC](https://discuss.elastic.co/t/seperate-dynamic-comma-seperated-field-into-multiple-fields/241103/3 "2020-08-11T16:30:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
