# Split a field value in a Visualization

**URL:** https://discuss.elastic.co/t/split-a-field-value-in-a-visualization/327303
**Category:** Kibana
**Tags:** painless, dashboard
**Created:** [March 8, 2023, 7:14pm UTC](https://discuss.elastic.co/t/split-a-field-value-in-a-visualization/327303 "2023-03-08T19:14:17Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![Jonathan\_Fernandez](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jonathan_fernandez/32/102934_2.png) [@Jonathan\_Fernandez](https://discuss.elastic.co/u/Jonathan_Fernandez)
#### Post date: [March 8, 2023, 7:14pm UTC](https://discuss.elastic.co/t/split-a-field-value-in-a-visualization/327303/1 "2023-03-08T19:14:17Z")

</div>

Hi everyone,

Currently I am trying to split the value of a field (an email) by the '@' in an "Aggregation Based - Data Table" visualization at Kibana, so the expected output for an email field with value _[name@domain.com](mailto:name@domain.com)_ would be:

- field 1: _name_
- field 2: _domain_

I have no access to filebeat, which I guess will be th eassiest way to do it, so I tried to apply a painless like substring script and a processor at Advance settings (the JSON script option within the Visualization), as expected, nothing worked.

![image](https://us1.discourse-cdn.com/elastic/original/3X/8/1/8191193517bcdc236619f70b87ed7bed689955fa.png)

It is possible to do such an split at this Kibana visualization (or another one) or I have to go to Logstash?

Thank you in advance!

---

<div class="post-metadata">

### Author: ![mhoward](https://avatars.discourse-cdn.com/v4/letter/m/4da419/32.png) [@mhoward](https://discuss.elastic.co/u/mhoward)
#### Post date: [March 8, 2023, 7:33pm UTC](https://discuss.elastic.co/t/split-a-field-value-in-a-visualization/327303/2 "2023-03-08T19:33:12Z")

</div>

Could you use an ingest pipeline? A dissect processor with a pattern something like %{name}@%{domain} would do the trick.

---

<div class="post-metadata">

### Author: ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [March 9, 2023, 2:40am UTC](https://discuss.elastic.co/t/split-a-field-value-in-a-visualization/327303/3 "2023-03-09T02:40:49Z")

</div>

Or two runtime fields depending what version you are on.

---

<div class="post-metadata">

### Author: ![Jonathan\_Fernandez](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jonathan_fernandez/32/102934_2.png) [@Jonathan\_Fernandez](https://discuss.elastic.co/u/Jonathan_Fernandez)
#### Post date: [March 9, 2023, 7:37am UTC](https://discuss.elastic.co/t/split-a-field-value-in-a-visualization/327303/4 "2023-03-09T07:37:53Z")

</div>

Thank you both guys! I'll add this change to Logstash then 😃

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 6, 2023, 7:38am UTC](https://discuss.elastic.co/t/split-a-field-value-in-a-visualization/327303/5 "2023-04-06T07:38:08Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.