# Split a string with delimiter and assign to new key - logstash

**URL:** <https://discuss.elastic.co/t/split-a-string-with-delimiter-and-assign-to-new-key-logstash/95056>\
**Category:** Logstash\
**Created:** [July 30, 2017, 1:30am UTC](https://discuss.elastic.co/t/split-a-string-with-delimiter-and-assign-to-new-key-logstash/95056 "2017-07-30T01:30:21Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Drift](https://avatars.discourse-cdn.com/v4/letter/d/8797f3/32.png) [@Drift](https://discuss.elastic.co/u/Drift)\
**Post date:** [July 30, 2017, 1:30am UTC](https://discuss.elastic.co/t/split-a-string-with-delimiter-and-assign-to-new-key-logstash/95056/1 "2017-07-30T01:30:22Z")

</div>

I am trying to import csv into elasticsearch using logstash. I have a field in the csv with is an IP:Port pair. I would like to split the IP and port, and assign them to two new keys though the logstash config file.

I looked into kv , but kv seems to require the keys and values pair in the string. Mine is only value.

Sample csv data:

hostname1,172.20.28.11:8080,proxy\_web,false  
hostname2,172.20.28.20:443,web\_https,false

In the above case, I already map the second field as "IP\_Port" (using csv=\> column) Now, I want to split 172.20.28.11:8080 as IP=172.20.28.11 and port=8080 (key=IP,value=172.20.28.11) and alike for port. Then mutate the datatype for the IP as 'ip datatype'.

After that, I can include the IP to geoip conversion using the following snippet, if I want to convert that extracted IP and use it to do geomapping.

geoip {  
source =\> "Source IP"  
target =\> "geoip"  
database =\> "/etc/logstash/GeoLiteCity.dat"  
add\_field =\> ["[geoip][coordinates]", "%{[geoip][longitude]}" ]  
add\_field =\> ["[geoip][coordinates]", "%{[geoip][latitude]}" ]  
}  
mutate {  
convert =\> ["[geoip][coordinates]", "float"]  
}  
Any suggestions on this?

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [July 30, 2017, 7:22am UTC](https://discuss.elastic.co/t/split-a-string-with-delimiter-and-assign-to-new-key-logstash/95056/2 "2017-07-30T07:22:58Z")

</div>

Use a csv filter to parse the record and get the ip and port into a single field. Then run another csv filter on the ip field, but with `:` used as a separator. You could use a grok or dissect filter as well.

---

<div class="post-metadata">

**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\
**Post date:** [July 30, 2017, 1:52pm UTC](https://discuss.elastic.co/t/split-a-string-with-delimiter-and-assign-to-new-key-logstash/95056/3 "2017-07-30T13:52:59Z")

</div>

You don't need the `add_field` directives. The geoip plugin does all that for you. I would use a mapping rather than setting the field as a float with `mutate`.

---

<div class="post-metadata">

**Author:** ![Drift](https://avatars.discourse-cdn.com/v4/letter/d/8797f3/32.png) [@Drift](https://discuss.elastic.co/u/Drift)\
**Post date:** [July 31, 2017, 4:00am UTC](https://discuss.elastic.co/t/split-a-string-with-delimiter-and-assign-to-new-key-logstash/95056/4 "2017-07-31T04:00:24Z")

</div>

Thankyou for the suggestions All.  
I found the grok option gave me precisely what I wanted. I could extract the IP (v4 or v6) using the below. I realized I dont need the port into a field, so this one worked realy faster in terms of processing as well.

filter {  
grok {  
match =\> { "message" =\> "%{IP:peer\_ip}" }  
}  
}

---

<div class="post-metadata">

**Author:** ![Drift](https://avatars.discourse-cdn.com/v4/letter/d/8797f3/32.png) [@Drift](https://discuss.elastic.co/u/Drift)\
**Post date:** [July 31, 2017, 4:01am UTC](https://discuss.elastic.co/t/split-a-string-with-delimiter-and-assign-to-new-key-logstash/95056/5 "2017-07-31T04:01:47Z")

</div>

Thankyou Aaron. Figured it out the output mapping already had geo\_point mapping. So it worked out well.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 28, 2017, 4:01am UTC](https://discuss.elastic.co/t/split-a-string-with-delimiter-and-assign-to-new-key-logstash/95056/6 "2017-08-28T04:01:53Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.