# Split One Lined "Message" field information

**URL:** <https://discuss.elastic.co/t/split-one-lined-message-field-information/340281>\
**Category:** Elasticsearch\
**Created:** [August 7, 2023, 2:16pm UTC](https://discuss.elastic.co/t/split-one-lined-message-field-information/340281 "2023-08-07T14:16:09Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jennifer\_Coley](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jennifer_coley/32/122429_2.png) [@Jennifer\_Coley](https://discuss.elastic.co/u/Jennifer_Coley)\
**Post date:** [August 7, 2023, 2:16pm UTC](https://discuss.elastic.co/t/split-one-lined-message-field-information/340281/1 "2023-08-07T14:16:09Z")

</div>

Hi,

In my dynamic syslogs in eleasticsearch, A fields called "messages" has over 7 lines of data, I need to split that single line into different field. I have a special character "\r\n" before required split information

example my JSON message

`"message": "Incoming Text : \r\n Pepe Jeans \r\n Model 123456 \r\n Red \r\n Women \r\n 2019 Italy \r\n 6 foot,Blue,stripes,fasion \r\n 2 "`

I'm expecting to split this data each into different fields like  
field1: Pepe Jeans  
field2: Model 123456  
field3: Red  
field4: Women  
field5: 2019 Italy  
field6: 6 foot,Blue,stripes,fasion  
field7: 2

---

<div class="post-metadata">

**Author:** ![Wave](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wave/32/117242_2.png) [@Wave](https://discuss.elastic.co/u/Wave)\
**Post date:** [August 11, 2023, 6:32pm UTC](https://discuss.elastic.co/t/split-one-lined-message-field-information/340281/2 "2023-08-11T18:32:58Z")

</div>

Hi @Jennifer_Coley,  
You don't say how you are processing that field, but seems like using the [split](https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-split) feature of mutate might fit the bill.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 8, 2023, 6:33pm UTC](https://discuss.elastic.co/t/split-one-lined-message-field-information/340281/3 "2023-09-08T18:33:04Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.