# Split field values in logstash

**URL:** <https://discuss.elastic.co/t/split-field-values-in-logstash/240285>\
**Category:** Logstash\
**Created:** [July 8, 2020, 7:36am UTC](https://discuss.elastic.co/t/split-field-values-in-logstash/240285 "2020-07-08T07:36:10Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![Gauti](https://avatars.discourse-cdn.com/v4/letter/g/cdc98d/32.png) [@Gauti](https://discuss.elastic.co/u/Gauti)\
**Post date:** [July 8, 2020, 7:36am UTC](https://discuss.elastic.co/t/split-field-values-in-logstash/240285/1 "2020-07-08T07:36:10Z")

</div>

Hi All,

I'm ingesting data into elasticsearch using logstash http\_poller plugin. WE have a value which contains the location field like city, country  
e.g: Location : Chennai, India  
Is there a possible way to split this into  
City : Chennai  
Country : India

Or is there a way to remove chennai(city) from the field and have only country.  
Location : India

Thanks  
Gautham

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 8, 2020, 3:01pm UTC](https://discuss.elastic.co/t/split-field-values-in-logstash/240285/2 "2020-07-08T15:01:24Z")

</div>

I would try something like this:

```
mutate { split => { "Location" => "," } }
mutate { add_field => { "City" => "[Location][0]" "Country" => "[Location][1]" } }
mutate { strip => ["City", "Country"] }
```

---

<div class="post-metadata">

**Author:** ![Gauti](https://avatars.discourse-cdn.com/v4/letter/g/cdc98d/32.png) [@Gauti](https://discuss.elastic.co/u/Gauti)\
**Post date:** [July 9, 2020, 8:35am UTC](https://discuss.elastic.co/t/split-field-values-in-logstash/240285/3 "2020-07-09T08:35:35Z")

</div>

@Badger I tried this looks like its not splitting up, i'm getting the output as  
City : [Location][0]  
Country : [Location][1]

Thanks  
Gautham

---

<div class="post-metadata">

**Author:** ![Jenni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jenni/32/29684_2.png) [@Jenni](https://discuss.elastic.co/u/Jenni)\
**Post date:** [July 9, 2020, 8:53am UTC](https://discuss.elastic.co/t/split-field-values-in-logstash/240285/4 "2020-07-09T08:53:40Z")

</div>

> [@Badger](#):
>
> I would try something like this:
> 
> ```auto
> mutate { split => { "Location" => "," } }
> mutate { add_field => { "City" => "[Location][0]" "Country" => "[Location][1]" } }
> mutate { strip => ["City", "Country"] }
> 
> ```

That solution should work. Badger just forgot the `%{}`

```auto
mutate { split => { "Location" => "," } }
mutate { add_field => { "City" => "%{[Location][0]}" "Country" => "%{[Location][1]}" } }
mutate { strip => ["City", "Country"] }

```

---

<div class="post-metadata">

**Author:** ![Gauti](https://avatars.discourse-cdn.com/v4/letter/g/cdc98d/32.png) [@Gauti](https://discuss.elastic.co/u/Gauti)\
**Post date:** [July 9, 2020, 9:46am UTC](https://discuss.elastic.co/t/split-field-values-in-logstash/240285/5 "2020-07-09T09:46:06Z")

</div>

@Jenni Great its working.....awesome...One small problem there are few fields with three value pairs like "Unionbeach, NY, USA" any advice on how to merge this please.

Thanks  
Gautham

---

<div class="post-metadata">

**Author:** ![Jenni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jenni/32/29684_2.png) [@Jenni](https://discuss.elastic.co/u/Jenni)\
**Post date:** [July 9, 2020, 10:34am UTC](https://discuss.elastic.co/t/split-field-values-in-logstash/240285/6 "2020-07-09T10:34:59Z")

</div>

What result do you want to achieve? A third field for the state or "Unionbeach, NY" as the city?

---

<div class="post-metadata">

**Author:** ![Gauti](https://avatars.discourse-cdn.com/v4/letter/g/cdc98d/32.png) [@Gauti](https://discuss.elastic.co/u/Gauti)\
**Post date:** [July 9, 2020, 1:44pm UTC](https://discuss.elastic.co/t/split-field-values-in-logstash/240285/7 "2020-07-09T13:44:06Z")

</div>

I need the result like  
City : Unionbeach, NY  
Country : USA

Thanks  
Gautham

---

<div class="post-metadata">

**Author:** ![Jenni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jenni/32/29684_2.png) [@Jenni](https://discuss.elastic.co/u/Jenni)\
**Post date:** [July 9, 2020, 3:54pm UTC](https://discuss.elastic.co/t/split-field-values-in-logstash/240285/8 "2020-07-09T15:54:56Z")

</div>

In this case I would probably just use grok with the pattern `(?<City>.*), (?<Country>.*)$`

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 6, 2020, 3:54pm UTC](https://discuss.elastic.co/t/split-field-values-in-logstash/240285/9 "2020-08-06T15:54:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.