# Split event into multiple different messages **URL:** \ **Category:** Logstash\ **Created:** [June 27, 2018, 4:02pm UTC](https://discuss.elastic.co/t/split-event-into-multiple-different-messages/137659 "2018-06-27T16:02:16Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![jvolpi](https://avatars.discourse-cdn.com/v4/letter/j/96bed5/32.png) [@jvolpi](https://discuss.elastic.co/u/jvolpi)\ **Post date:** [June 27, 2018, 4:02pm UTC](https://discuss.elastic.co/t/split-event-into-multiple-different-messages/137659/1 "2018-06-27T16:02:16Z")
Hi everyone Is there a way to split an event into multiple messages, and send them to elasticsearh? The problem is the event cannot be splitted in a automatic way using plugins, because the data isn't exactly structured and may vary. The only option is to substring it with 'if' clauses and add new fields as is needed, so the splitted messages will be different between each other. If there is no way of doing this inside logstash, i guess i will have to pre-process the logs before sending them to logstash. Thanks in advance ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [June 27, 2018, 4:29pm UTC](https://discuss.elastic.co/t/split-event-into-multiple-different-messages/137659/2 "2018-06-27T16:29:42Z")
If you give an example we can help you. ---
**Author:** ![jvolpi](https://avatars.discourse-cdn.com/v4/letter/j/96bed5/32.png) [@jvolpi](https://discuss.elastic.co/u/jvolpi)\ **Post date:** [June 27, 2018, 5:10pm UTC](https://discuss.elastic.co/t/split-event-into-multiple-different-messages/137659/3 "2018-06-27T17:10:12Z")
Here is a simplified type of message: `msg = 03;00;00;00;00;54;D5;15;DC;CA;FF;05;A7;00;01` As you can see, the messages are just a bunch of bytes separated by semicolons. The thing is that sometimes a group of these bytes represents a single field in elasticsearch, so the spliting needs to be scripted. In this example i would compare the first byte ('03') to a specific value, if that checks then i would proceed to split the message in the following manner: ``` msg 1 = 03;00;00;00;00 msg 2 = 54;D5;15;DC;CA msg 3 = FF;05;A7;00;01 ``` Note: the start and end of each msg may vary, and i can determine those positions using 'if' clauses (the values checked aren't important, they are in each submessage and i only need to look for the 'first byte' of each one). After splitting the event, i need to assign new fields to each submessage in a scripted way (by using 'if' clauses, processing the bytes inside). All the messages will have the same fields, but the value of each one may be obtained in different ways. At this point i will have, theoretically, a list of different messages ready to be sent to elasticsearch. I hope that helps ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [June 27, 2018, 7:27pm UTC](https://discuss.elastic.co/t/split-event-into-multiple-different-messages/137659/4 "2018-06-27T19:27:01Z")
Use a ruby filter to rewrite the input string into an array of strings, then feed that field to a split filter. ---
**Author:** ![jvolpi](https://avatars.discourse-cdn.com/v4/letter/j/96bed5/32.png) [@jvolpi](https://discuss.elastic.co/u/jvolpi)\ **Post date:** [June 29, 2018, 6:50pm UTC](https://discuss.elastic.co/t/split-event-into-multiple-different-messages/137659/5 "2018-06-29T18:50:12Z")
Thank you, it worked for me. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 27, 2018, 6:50pm UTC](https://discuss.elastic.co/t/split-event-into-multiple-different-messages/137659/6 "2018-07-27T18:50:13Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.