# Split/explode strings

**URL:** <https://discuss.elastic.co/t/split-explode-strings/267369>\
**Category:** Logstash\
**Tags:** ingest-pipeline\
**Created:** [March 16, 2021, 12:36pm UTC](https://discuss.elastic.co/t/split-explode-strings/267369 "2021-03-16T12:36:12Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![cibernicola](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cibernicola/32/85621_2.png) [@cibernicola](https://discuss.elastic.co/u/cibernicola)\
**Post date:** [March 16, 2021, 12:36pm UTC](https://discuss.elastic.co/t/split-explode-strings/267369/1 "2021-03-16T12:36:12Z")

</div>

Hi, I have several text strings with separator patterns that I would like to be able to ingest as objects in elasticsearch, these strings are of the style:

(a) text|text   
b) number text|number text  
c) [mailto:text@text](mailto:text@text) | [mailto:text@text](mailto:text@text)

I have tried mutate split in cases A and C,  
for case C I have tried` kv { value_split => "|" field_split => " " source => "a" target => "a" }`,  
I have also tried for case A `ruby { code => "event.get('A').split('|')" }`, I can't get it to work in any case ☹  
Any hints or step by step guide you can think of?

---

<div class="post-metadata">

**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\
**Post date:** [March 16, 2021, 1:40pm UTC](https://discuss.elastic.co/t/split-explode-strings/267369/2 "2021-03-16T13:40:14Z")

</div>

Are you looking to do something like this? You can ingest them as an array like this.

**Conf**

```auto
input {
  generator {
    lines => [
     '[{ "test": "text1|text2" }, { "test2": "12|154" }, { "test3": "text2@text2|text@text" }]'
    ]
    count => 1
    codec => "json"
  }
}
filter {
    mutate {
        split => ["test", "|"]
        split => ["test2", "|"]
        split => ["test3", "|"]
    }
}
output {
  stdout { codec => json_lines }
}

```

**Output**

```auto
{
	"@version": "1",
	"test": ["text1", "text2"],
	"@timestamp": "2021-03-16T13:36:49.215Z",
	"host": "Aarons-MBP.domain",
	"sequence": 0
} {
	"@version": "1",
	"test3": ["text2@text2", "text@text"],
	"@timestamp": "2021-03-16T13:36:49.215Z",
	"host": "Aarons-MBP.domain",
	"sequence": 0
} {
	"@version": "1",
	"host": "Aarons-MBP.domain",
	"@timestamp": "2021-03-16T13:36:49.215Z",
	"sequence": 0,
	"test2": ["12", "154"]
}

```

---

<div class="post-metadata">

**Author:** ![cibernicola](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cibernicola/32/85621_2.png) [@cibernicola](https://discuss.elastic.co/u/cibernicola)\
**Post date:** [March 16, 2021, 2:56pm UTC](https://discuss.elastic.co/t/split-explode-strings/267369/3 "2021-03-16T14:56:03Z")

</div>

I'm gonna try (thanks!) but not sure how, sorry, my mistake, all strings are fiels coming froma csv file.

More info:

- I want to split emails strings like: [mailto:name@domain.tld](mailto:name@domain.tld) to get domain.tld in a new field. and also, if possible, user part, without "mailto:".
- I have string like: string1|string2 (that may have, 1, 2, 3 or more "fields".
- Finally I have number string | number2 string (from 1 to x) that I need to parse to key pair into new fields.

* * *

- Everything works, I mean, logstash ingests all data with mutate split, for example, it does nothing :S

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 13, 2021, 2:56pm UTC](https://discuss.elastic.co/t/split-explode-strings/267369/4 "2021-04-13T14:56:30Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.