# Split an output of a kv filter
**URL:** https://discuss.elastic.co/t/split-an-output-of-a-kv-filter/184614
**Category:** Logstash
**Created:** [June 6, 2019, 3:06pm UTC](https://discuss.elastic.co/t/split-an-output-of-a-kv-filter/184614 "2019-06-06T15:06:40Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@arjun\_purushotham](https://discuss.elastic.co/u/arjun_purushotham)
#### Post date: [June 6, 2019, 3:06pm UTC](https://discuss.elastic.co/t/split-an-output-of-a-kv-filter/184614/1 "2019-06-06T15:06:40Z")
Hi
Below is my logstash filter configuration.
filter {
if [type] in ["apache" , "apache\_access" , "apache-access"] {
grok {
match =\> [
"message" , "%{COMBINEDAPACHELOG}+%{GREEDYDATA:extra\_fields}",
"message" , "%{COMMONAPACHELOG}+%{GREEDYDATA:extra\_fields}"
]
overwrite =\> ["message"]
}
kv {
source =\> "extra\_fields"
field\_split =\> ",/"
}
csv {
source =\> "extra\_fields"
target =\> "fieldlist"
}
```
mutate {
convert => ["response", "integer"]
convert => ["bytes", "integer"]
convert => ["responsetime", "float"]
}
```
mutate {
split =\> {"extra\_fields" =\> "," }
}
```
geoip {
source => "clientip"
target => "geoip"
add_tag => ["apache-geoip"]
}
date {
match => ["timestamp" , "dd/MMM/YYYY:HH:mm:ss Z"]
remove_field => ["timestamp"]
}
useragent {
source => "agent"
}
```
}
How can i Split data of fieldlist even more.
ie,
 I want to filter fieldlist.column4 even more till the third occurence of a '/' and store it in a new field.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 6, 2019, 11:58pm UTC](https://discuss.elastic.co/t/split-an-output-of-a-kv-filter/184614/2 "2019-06-06T23:58:18Z")
Please do not post pictures of text, just post the text. You need to split the field called fieldlist.column4. What is the pattern of the data in that field, and can you provide an example of the data?
Given that you have not shown what the input data looks like, it does not help us to help you for you to show us the rest of your configuration.
---
### Author:  [@arjun\_purushotham](https://discuss.elastic.co/u/arjun_purushotham)
#### Post date: [June 7, 2019, 6:46am UTC](https://discuss.elastic.co/t/split-an-output-of-a-kv-filter/184614/3 "2019-06-07T06:46:20Z")
Hi Badger,
Thanks for the reply.
Input to Field is
[careers.azimpremjifoundation.org](http://careers.azimpremjifoundation.org), 1160476, 200, POST /ApplyJobAPI/applyJobWithCustomFields HTTP/1.1
Here
fieldlist.column1 will have data as [careers.azimpremjifoundation.org](http://careers.azimpremjifoundation.org)
fieldlist.column2 will have data as 1160476
fieldlist.column3 will have data as 200
fieldlist.column4 will have data as /ApplyJobAPI/applyJobWithCustomFields HTTP/1.1
My fieldlist.column4 has data's like:
1. /ccubeAPI/getCompanyConfigurationDetails/15119
2. /profileAPI/getProfile/1209895
3. /manage/angular-pages/custom-fields-directive.html
4. /userAPI/loginAccess
5. /common-files-v1.0/common-htmls/view-file-template.html
6. /ccubeAPI/getJobForUrl/teacher-educator-chhattisgarh-india-karnataka-india-madhya-pradesh-india-puducherry-india-rajasthan-india-telangana-india-uttarakhand-india-201901260802088.
So from this I have to Filter fieldlist.column4 data till the third occurence of a '/' and store it in a new field.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 7, 2019, 1:15pm UTC](https://discuss.elastic.co/t/split-an-output-of-a-kv-filter/184614/4 "2019-06-07T13:15:43Z")
Does
```
grok { match => { "[fieldlist][column4]" => "^(?/[^/]+/[^/]+/)" } }
```
do what you want?
---
### Author:  [@arjun\_purushotham](https://discuss.elastic.co/u/arjun_purushotham)
#### Post date: [June 7, 2019, 1:25pm UTC](https://discuss.elastic.co/t/split-an-output-of-a-kv-filter/184614/5 "2019-06-07T13:25:20Z")
Kudos!!!
This does my work:)
Thank You So much Badger.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 5, 2019, 1:25pm UTC](https://discuss.elastic.co/t/split-an-output-of-a-kv-filter/184614/6 "2019-07-05T13:25:24Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.