# Split field into multiple fields
**URL:** https://discuss.elastic.co/t/split-field-into-multiple-fields/284096
**Category:** Logstash
**Created:** [September 13, 2021, 3:34pm UTC](https://discuss.elastic.co/t/split-field-into-multiple-fields/284096 "2021-09-13T15:34:54Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@mavericknd](https://discuss.elastic.co/u/mavericknd)
#### Post date: [September 13, 2021, 3:34pm UTC](https://discuss.elastic.co/t/split-field-into-multiple-fields/284096/1 "2021-09-13T15:34:54Z")
Hi,
i have the following log and want the key value pairs inside message (ipAddress=1.1.1.1 realmId=some\_realm) to be separate fields. I tried with grok, kv, mutate, nothing works, no change in kibana.
If somebody can help, please.
@timestamp: Sep 13, 2021 @ 14:43:38.265 @version: 1 @version.keyword: 1 facility: logstash-gelf
facility.keyword: logstash-gelf host: etcd1 host.keyword: etcd1 level: 4 LoggerName: org.keycloak.events LoggerName.keyword: org.keycloak.events message: type=LOGIN\_ERROR, realmId=master, clientId=null, userId=null, ipAddress=192.168.3.6, error=expired\_code, restart\_after\_timeout=true, authSessionParentId=fab5767d-8c66-47cd-9479-3b2c6e8bbfd2, authSessionTabId=kGyxYwuAu6I message.keyword: type=LOGIN\_ERROR, realmId=master, clientId=null,
---
### Author:  [@AquaX](https://discuss.elastic.co/u/AquaX)
#### Post date: [September 14, 2021, 8:22pm UTC](https://discuss.elastic.co/t/split-field-into-multiple-fields/284096/2 "2021-09-14T20:22:41Z")
> [@mavericknd](#):
>
> type=LOGIN\_ERROR, realmId=master, clientId=null, userId=null, ipAddress=192.168.3.6, error=expired\_code, restart\_after\_timeout=true, authSessionParentId=fab5767d-8c66-47cd-9479-3b2c6e8bbfd2, authSessionTabId=kGyxYwuAu6I message.keyword: type=LOGIN\_ERROR, realmId=master, clientId=null
The [kv](https://www.elastic.co/guide/en/logstash/current/plugins-filters-kv.html) filter should take care of this.
`filter { kv { field_split_pattern => ", " } }`
---
### Author:  [@mavericknd](https://discuss.elastic.co/u/mavericknd)
#### Post date: [September 17, 2021, 7:02am UTC](https://discuss.elastic.co/t/split-field-into-multiple-fields/284096/3 "2021-09-17T07:02:50Z")
Unfortunately it doesn't work. Not even with ",\s"
---
### Author:  [@mavericknd](https://discuss.elastic.co/u/mavericknd)
#### Post date: [September 17, 2021, 2:14pm UTC](https://discuss.elastic.co/t/split-field-into-multiple-fields/284096/4 "2021-09-17T14:14:29Z")
i managed to make it work. I had a typo
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 15, 2021, 2:14pm UTC](https://discuss.elastic.co/t/split-field-into-multiple-fields/284096/5 "2021-10-15T14:14:38Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.