# Split field logstash
**URL:** https://discuss.elastic.co/t/split-field-logstash/112217
**Category:** Logstash
**Created:** [December 18, 2017, 11:21am UTC](https://discuss.elastic.co/t/split-field-logstash/112217 "2017-12-18T11:21:58Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@sureshboiina](https://discuss.elastic.co/u/sureshboiina)
#### Post date: [December 18, 2017, 11:21am UTC](https://discuss.elastic.co/t/split-field-logstash/112217/1 "2017-12-18T11:21:58Z")
hi
**input**
`2017-12-18 16:50:54.462 [http-bio-8080-exec-9] DEBUG o.s.w.f.CommonsRequestLoggingFilter.afterRequest(55) - After request [uri=/tng-rfid-api-gateway/gateway/api/v1/pre-checks/01;client=172.31.100.151;user=admin;payload={"header":{"sourceRefNo":"12341232017121200999","SPID":"1234","LOCID":"123","requestType":"01","timestamp":"2017-03-03T10:02:03.215+08:00"},"body":{"idType":"2","idNumber":"H12345777","nationality":"MYS","vehicleRegNo":"WWW123","vehicleRegCountry":"MYS","oldTagID":"","sourceAccNo":"","vectorAccNo":"","remark":""}}]`
**`using code**
```
kv {
source => "tx"
field_split => ";"
remove_char_value => "\[\]"
target => "final"
}
```
getting output:
final.user-admin
final.client-172.31.100.151
final.2017-12-18 16:50:54.462 [http-bio-8080-exec-9] DEBUGo.s.w.f.CommonsRequestLoggingFilter.afterRequest(55) - After request [uri
- **tng-rfid-api-gateway/gateway/api/v1/pre-checks/01**
final.payload-{"header":{"sourceRefNo":"12341232017121200999","SPID":"1234","LOCID":"123","requestType":"01","timestamp":"2017-03-03T10:02:03.215+08:00"},"body":{"idType":"2","idNumber":"H12345777","nationality":"MYS","vehicleRegNo":"WWW123","vehicleRegCountry":"MYS","oldTagID":"","sourceAccNo":"","vectorAccNo":"","remark":""}}
Above everything ok but for uri it should not get entire string expected is
**final.uri-tng-rfid-api-gateway/gateway/api/v1/pre-checks/01**
so can u guys let me know is there way to accomplish this
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [December 18, 2017, 11:41am UTC](https://discuss.elastic.co/t/split-field-logstash/112217/2 "2017-12-18T11:41:50Z")
I don't get it. What does the `tx` field contain?
---
### Author:  [@sureshboiina](https://discuss.elastic.co/u/sureshboiina)
#### Post date: [December 18, 2017, 11:43am UTC](https://discuss.elastic.co/t/split-field-logstash/112217/3 "2017-12-18T11:43:55Z")
tx is actual message which i given as input
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [December 18, 2017, 2:07pm UTC](https://discuss.elastic.co/t/split-field-logstash/112217/4 "2017-12-18T14:07:19Z")
Please show the rest of your filters. It looks like you're indeed asking the kv filter to parse the whole input string, including the timestamp.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 15, 2018, 2:08pm UTC](https://discuss.elastic.co/t/split-field-logstash/112217/5 "2018-01-15T14:08:04Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.