# Spilt an Event Into 2
**URL:** https://discuss.elastic.co/t/spilt-an-event-into-2/69219
**Category:** Logstash
**Created:** [December 15, 2016, 9:33pm UTC](https://discuss.elastic.co/t/spilt-an-event-into-2/69219 "2016-12-15T21:33:17Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@Nastooh](https://discuss.elastic.co/u/Nastooh)
#### Post date: [December 15, 2016, 9:33pm UTC](https://discuss.elastic.co/t/spilt-an-event-into-2/69219/1 "2016-12-15T21:33:17Z")
Hi
I've been looking at similar QA on similar topic, and couldn't find an applicable answer. I think I have a simple case, i.e., I get records of form:
who="Mr. boo", A1=v1,A2=v2
and what I would like to get are 2 records:
{who:"Mr. boo",
A\_type:A1,
A\_val:v1}
{who:Mr. boo",
A\_type:A2,
A\_val:v2}
My initial attempt was to use 2 grok filters:
who=%{DATA:who},%{DATA:A\_type}=%{NUMBER:A\_val},%{GREEDYDATA:skip}
who=%{DATA:who},%{GREEDYDATA:skip},%{DATA:A\_type}=%{NUMBER:A\_val}
This gives me:
{who:["Mr. boo","Mr. boo"],
A\_type:[A1,A2],
A\_val:[v1,v2]}
I not sure how to split these arrays into separate events.
Setup: LS 2.2.4, ES:2.4.1(Lucene:5.5.2) and Kibana:4.4.2
Cheers,
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [December 15, 2016, 10:17pm UTC](https://discuss.elastic.co/t/spilt-an-event-into-2/69219/2 "2016-12-15T22:17:43Z")
Use the clone filter, then drop fields accordingly.
---
### Author:  [@Nastooh](https://discuss.elastic.co/u/Nastooh)
#### Post date: [December 15, 2016, 11:47pm UTC](https://discuss.elastic.co/t/spilt-an-event-into-2/69219/3 "2016-12-15T23:47:44Z")
Thank you Mark. Would this go something like this:
clone {
clones =\> ["message", "Event\_1"] //To preserve the original event
}
clone {
clones =\> ["Event\_2"] // Clone it
}
//Process individually
grok{
match =\> {"Event\_1"=\>"who=%{DATA:who},%{DATA:A\_type}=%{NUMBER:A\_val},%{GREEDYDATA:skip}"}
}
grok{
match =\> {"Event\_2"=\>"who=%{DATA:who},%{GREEDYDATA:skip},%{DATA:A\_type}=%{NUMBER:A\_val}"}
}
Cheers,
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 12, 2017, 11:48pm UTC](https://discuss.elastic.co/t/spilt-an-event-into-2/69219/4 "2017-01-12T23:48:02Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.