# Split array with multiple identical keys

**URL:** <https://discuss.elastic.co/t/split-array-with-multiple-identical-keys/174797>\
**Category:** Logstash\
**Created:** [April 1, 2019, 1:43pm UTC](https://discuss.elastic.co/t/split-array-with-multiple-identical-keys/174797 "2019-04-01T13:43:13Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![jbm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jbm/32/43221_2.png) [@jbm](https://discuss.elastic.co/u/jbm)\
**Post date:** [April 1, 2019, 1:43pm UTC](https://discuss.elastic.co/t/split-array-with-multiple-identical-keys/174797/1 "2019-04-01T13:43:13Z")

</div>

I am working on splitting out an array that has multiple identical values. The message is json, and I run the whole message through a json filter plugin before trying to parse out the "threatsInfoMap" field. Currently it is only capturing the first object in the array, but I would like to capture all of them (my sample array has two objects, I have seen up to 5).

My configuration:

```
json {
  source => "message"
} split {
  field => "threatsInfoMap"
}

```

Sample Data:

```
"threatsInfoMap": [
                       {
                           "threatID": "legitimate_id_code1",
                           "threatStatus": "active",
                           "classification": "spam",
                           "threatUrl": "https://sampleurl.com/1",
                           "threatTime": "2019-03-31T19:22:46.000Z",
                           "threat": "valid_ioc1",
                           "campaignID": "valid_id1",
                           "threatType": "url"
                       },
                       {
                           "threatID": "legitimate_id_code2",
                           "threatStatus": "active",
                           "classification": "spam",
                           "threatUrl": "https://sampleurl.com/2",
                           "threatTime": "2019-03-31T09:39:00.000Z",
                           "threat": "valid_ioc2",
                           "campaignID": "valid_id2",
                           "threatType": "url"
                       }
                   ],
```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 1, 2019, 2:06pm UTC](https://discuss.elastic.co/t/split-array-with-multiple-identical-keys/174797/2 "2019-04-01T14:06:30Z")

</div>

I do not understand the question. When you use a split filter each event will contain a single entry from the array. I would expect you to get

```
{
"threatsInfoMap" => {
          "threatID" => "legitimate_id_code1",
        "threatType" => "url",
        "campaignID" => "valid_id1",
        "threatTime" => "2019-03-31T19:22:46.000Z",
            "threat" => "valid_ioc1",
    "classification" => "spam",
         "threatUrl" => "https://sampleurl.com/1",
      "threatStatus" => "active"
    }
}
{
"threatsInfoMap" => {
          "threatID" => "legitimate_id_code2",
        "threatType" => "url",
        "campaignID" => "valid_id2",
        "threatTime" => "2019-03-31T09:39:00.000Z",
            "threat" => "valid_ioc2",
    "classification" => "spam",
         "threatUrl" => "https://sampleurl.com/2",
      "threatStatus" => "active"
    }
}

```

as two separate events. What are you getting?

---

<div class="post-metadata">

**Author:** ![jbm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jbm/32/43221_2.png) [@jbm](https://discuss.elastic.co/u/jbm)\
**Post date:** [April 1, 2019, 2:12pm UTC](https://discuss.elastic.co/t/split-array-with-multiple-identical-keys/174797/3 "2019-04-01T14:12:24Z")

</div>

I am just getting

```
{
"threatsInfoMap" => {
      "threatID" => "legitimate_id_code1",
    "threatType" => "url",
    "campaignID" => "valid_id1",
    "threatTime" => "2019-03-31T19:22:46.000Z",
        "threat" => "valid_ioc1",
"classification" => "spam",
     "threatUrl" => "https://sampleurl.com/1",
  "threatStatus" => "active"
 }
}

```

The second object isn't there.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 1, 2019, 2:22pm UTC](https://discuss.elastic.co/t/split-array-with-multiple-identical-keys/174797/4 "2019-04-01T14:22:25Z")

</div>

I cannot think of an explanation for that.

---

<div class="post-metadata">

**Author:** ![jbm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jbm/32/43221_2.png) [@jbm](https://discuss.elastic.co/u/jbm)\
**Post date:** [April 1, 2019, 2:26pm UTC](https://discuss.elastic.co/t/split-array-with-multiple-identical-keys/174797/5 "2019-04-01T14:26:14Z")

</div>

Thanks for taking a look.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 29, 2019, 2:26pm UTC](https://discuss.elastic.co/t/split-array-with-multiple-identical-keys/174797/6 "2019-04-29T14:26:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.