# Split an event into multiple events
**URL:** https://discuss.elastic.co/t/split-an-event-into-multiple-events/95174
**Category:** Logstash
**Created:** [July 31, 2017, 11:14am UTC](https://discuss.elastic.co/t/split-an-event-into-multiple-events/95174 "2017-07-31T11:14:40Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@Nikhil\_Utane](https://discuss.elastic.co/u/Nikhil_Utane)
#### Post date: [July 31, 2017, 11:14am UTC](https://discuss.elastic.co/t/split-an-event-into-multiple-events/95174/1 "2017-07-31T11:14:40Z")
Hi,
I have a following incoming event.I need to extract [custombeat][parameters] fields (highlighted in bold) into multiple events.
i.e. event1: type=lte, status=3
event2: type=cpu, status=0
event3: type=network, status=0
event4: type=memory, status=3
`
> [2017-07-31T16:07:36,530][DEBUG][logstash.pipeline] filter received {"event"=\>{"custombeat"=\>{"parameters"=\> **{"lte\_status"=\>3, "cpu\_status"=\>0, "network\_status"=\>0, "memory\_status"=\>3}** }, "@timestamp"=\>2017-07-31T10:40:10.447Z, "beat"=\>{"hostname"=\>"localhost.localdomain", "name"=\>"localhost.localdomain", "version"=\>"5.5.2"}, "@version"=\>"1", "host"=\>"localhost.localdomain", "metricset"=\>{"rtt"=\>6, "module"=\>"custombeat", "name"=\>"parameters", "host"=\>"localhost"}, "type"=\>"metricsets", "fields"=\>{"document\_type"=\>"custommetrics"}, "tags"=\>["beats\_input\_raw\_event"]}}
`
If required, I can suitably modify the incoming event into a format that is easy to parse/split but ultimately I need them to go into elasticsearch in the format that I have mentioned. I suppose I can use ruby code or split plugin but not able to get it to work.
Thanks
Nikhil
---
### Author:  [@Nikhil\_Utane](https://discuss.elastic.co/u/Nikhil_Utane)
#### Post date: [July 31, 2017, 11:50am UTC](https://discuss.elastic.co/t/split-an-event-into-multiple-events/95174/2 "2017-07-31T11:50:09Z")
To ask the question more clearly, if I can modify by custombeat module to send the data in this format instead then I should simply be able to use the split filter.
{"summary" : [{ "name": "cpu", "status": "0"}, {"name": "memory", "status": "1"}]}
How to achieve this? Thanks.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 28, 2017, 11:50am UTC](https://discuss.elastic.co/t/split-an-event-into-multiple-events/95174/3 "2017-08-28T11:50:17Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.