# Seperating fields in a string

**URL:** <https://discuss.elastic.co/t/seperating-fields-in-a-string/115193>\
**Category:** Logstash\
**Created:** [January 12, 2018, 12:27am UTC](https://discuss.elastic.co/t/seperating-fields-in-a-string/115193 "2018-01-12T00:27:59Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sjaak01](https://avatars.discourse-cdn.com/v4/letter/s/73ab20/32.png) [@Sjaak01](https://discuss.elastic.co/u/Sjaak01)\
**Post date:** [January 12, 2018, 12:27am UTC](https://discuss.elastic.co/t/seperating-fields-in-a-string/115193/1 "2018-01-12T00:27:59Z")

</div>

Hello,

I will attempt this once more, hopefully somebody can help me out because I'm breaking my head over this one.

I'm using the throttle filter and I need to combine a string of fields I want to throttle.

```auto
throttle {
    before_count => -1
    after_count => 1
    period => 120
    max_age => 7200
    key => "%{temp}%{error}%EbNo%state"
    add_tag => "throttled"
  }
```

`%{temp}%{error}` works as intended, every unique value (e.g. error1, error2, error3) within the throttle window is saved but no same value is logged twice.

The problem is with the `%EbNo%state`. In this case I want to log ONE message PER field. However this string only logs ONE message regardless of the field. So instead of getting for example ebno: 20 and state: 30, only ebno is logged and state field value is ignored until the throttle period resets.

The docs offer no information from which I can deduct how the write the string I need.

Any help would be greatly appreciated. I went over about every type of string I could think of but whatever I do I never got the last part to work.

> key  
> edit
> 
> ```
> This is a required setting.
> Value type is string
> There is no default value for this setting. 
> 
> ```
> 
> The key used to identify events. Events with the same key are grouped together. Field substitutions are allowed, so you can combine multiple fields.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 9, 2018, 12:28am UTC](https://discuss.elastic.co/t/seperating-fields-in-a-string/115193/2 "2018-02-09T00:28:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.