# Split field in a json event

**URL:** <https://discuss.elastic.co/t/split-field-in-a-json-event/39875>\
**Category:** Logstash\
**Created:** [January 22, 2016, 12:44pm UTC](https://discuss.elastic.co/t/split-field-in-a-json-event/39875 "2016-01-22T12:44:00Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![golauty](https://avatars.discourse-cdn.com/v4/letter/g/eada6e/32.png) [@golauty](https://discuss.elastic.co/u/golauty)\
**Post date:** [January 22, 2016, 12:44pm UTC](https://discuss.elastic.co/t/split-field-in-a-json-event/39875/1 "2016-01-22T12:44:00Z")

</div>

Hi all,

how can i split a field in a nested JSON Event?

Following message arrives:

```auto
"_index": "logstash-2016.01.22",
  "_type": "jenkins",
  "_id": "AVJo32hNLCqC9e2Mq6d2",
  "_score": null,
  "_source": {
    "data": {
      "id": "1092",
      "projectName": "Run_Single__suite",
      "displayName": "#1092",
      "fullDisplayName": "Run_Single_suite #1092",
      "url": "job/Run_Single_suite/1092/",
      "buildHost": "Jenkins",
      "buildLabel": "master",
      "buildNum": 1092,
      "buildDuration": 1,
      "rootProjectName": "Run_Single_suite",
      "rootProjectDisplayName": "#1092",
      "rootBuildNum": 1092,
      "buildVariables": {
        "target_SUT": "0101",
        "report_warnings": "false",
        "product": "XXXX",
        "testsuite": "TeamZXZ\\vol.tcs.assortment",
        "qft_version": "current",
        "target_task": "t-0426",
        "branch": "branches/7.1",
        "testcase": "",
        "revision": "HEAD",
        "node": "xxxxxxx",
        "client": "xxxxx",
        "run_specific_test": "false",
        "user": "xxxxxr"
      }
    }

```

Now i want to split the field testsuite in two fields with the name teamname and testsuite.  
How can i do that?  
I tried with:

```auto
mutate 
{
            split => {"[_source][data][buildVariables][testsuite]" => "\\"}
            add_field => { "teamname" => "%{[_source][data][buildVariables][testsuite][0]}" }
            add_field => { "testsuite" => "%{[_source][data][buildVariables][testsuite][1]}" }
}

```

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [January 23, 2016, 4:59pm UTC](https://discuss.elastic.co/t/split-field-in-a-json-event/39875/2 "2016-01-23T16:59:59Z")

</div>

Remove [\_source] from the field references. Otherwise what you're doing should work. Another way would be to use the grok filter.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:14am UTC](https://discuss.elastic.co/t/split-field-in-a-json-event/39875/3 "2017-07-06T05:14:38Z")

</div>