# Split filter on an array containing only one element

**URL:** <https://discuss.elastic.co/t/split-filter-on-an-array-containing-only-one-element/35684>\
**Category:** Logstash\
**Created:** [November 26, 2015, 3:21pm UTC](https://discuss.elastic.co/t/split-filter-on-an-array-containing-only-one-element/35684 "2015-11-26T15:21:43Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![pdesoyres](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pdesoyres/32/509_2.png) [@pdesoyres](https://discuss.elastic.co/u/pdesoyres)\
**Post date:** [November 26, 2015, 3:21pm UTC](https://discuss.elastic.co/t/split-filter-on-an-array-containing-only-one-element/35684/1 "2015-11-26T15:21:43Z")

</div>

Hello,

I'm trying to split the result of an elasticsearch aggregation into several events. Everything is working fine when there are multiple buckets in the result. I'm facing an issue when there is only one bucket. The split filter doesn't work anymore.

Here is my configuration

```
input {
  stdin {
    type => "indexMetric"
  }
}
filter {
  json {
    source => "message"
  }

  split {
    field => "aggregations[count_by_idx][buckets]"
    target => "metric"
  }
}
output {
  stdout {
    codec => rubydebug
  }
}

```

Given the initial message (which corresponds to the result of a simple aggregation) :

```
{
  "aggregations": {
    "count_by_type": {
      "buckets": [
        {
          "key": "email",
          "doc_count": 512
        },
        {
          "key": "chat",
          "doc_count": 3
        }
      ]
    }
  }
}

```

I get the two expected events with field "metric" :

```
"metric"=>{"key"=>"email", "doc_count"=>512}
"metric"=>{"key"=>"chat", "doc_count"=>3}

```

But with the following message (which has got only one bucket) :

```
{
  "aggregations": {
    "count_by_type": {
      "buckets": [
        {
          "key": "email",
          "doc_count": 512
        }
      ]
    }
  }
}

```

There is no split event meaning that the split filter doesn't generate any event.

Am I facing a bug ? Is this the desired behaviour ? Do you know any workaround that could make me handle this case ?

(I am using logstash 2.0.0)

Thanks by advance.

_Pierre_

---

<div class="post-metadata">

**Author:** ![pdesoyres](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pdesoyres/32/509_2.png) [@pdesoyres](https://discuss.elastic.co/u/pdesoyres)\
**Post date:** [November 26, 2015, 3:51pm UTC](https://discuss.elastic.co/t/split-filter-on-an-array-containing-only-one-element/35684/2 "2015-11-26T15:51:07Z")

</div>

I reply to myself since I would like to share the workaround I found so far. It consists of using ruby filter to get number of buckets. And if this number is one, then use ruby filter again to add to the event the metric field with the single bucket.

```
input {
  stdin {
     type => "indexMetric"
  }
}
filter {
  json {
    source => "message"
  }

  #get number of buckets
  ruby {
    code => "event['nb_buckets'] = event['aggregations']['count_by_idx']['buckets'].length"
  }

  if [nb_buckets] == 1 {
    # copy first bucket into metric field using ruby filter
    ruby {
      code => "event['metric'] = event['aggregations']['count_by_idx']['buckets'][0]"
    }
  } else {
    # otherwise use split filter
    split {
      field => "aggregations[count_by_idx][buckets]"
      target => "metric"
    }
  }

  # remove the temporary nb_buckets field
  mutate {
    remove_field => "nb_buckets"
  }
}
output {
  stdout {
    codec => rubydebug
  }
}

```

Tell me if you know a more appropriate way to do that.

_Pierre_

---

<div class="post-metadata">

**Author:** ![davidbkemp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/davidbkemp/32/594_2.png) [@davidbkemp](https://discuss.elastic.co/u/davidbkemp)\
**Post date:** [January 6, 2016, 8:45pm UTC](https://discuss.elastic.co/t/split-filter-on-an-array-containing-only-one-element/35684/3 "2016-01-06T20:45:14Z")

</div>

I have just run into a similar problem. Feels like a bug in split to me.

---

<div class="post-metadata">

**Author:** ![jmonsinjon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jmonsinjon/32/8609_2.png) [@jmonsinjon](https://discuss.elastic.co/u/jmonsinjon)\
**Post date:** [March 22, 2016, 4:16pm UTC](https://discuss.elastic.co/t/split-filter-on-an-array-containing-only-one-element/35684/4 "2016-03-22T16:16:03Z")

</div>

I think so... Same problem. Thanks for your solution.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:05am UTC](https://discuss.elastic.co/t/split-filter-on-an-array-containing-only-one-element/35684/5 "2017-07-06T05:05:52Z")

</div>