# Split - Only String and Array types are splittable. field:\[value\] is of type = NilClass

**URL:** <https://discuss.elastic.co/t/split-only-string-and-array-types-are-splittable-field-value-is-of-type-nilclass/213154>\
**Category:** Logstash\
**Created:** [December 27, 2019, 8:11am UTC](https://discuss.elastic.co/t/split-only-string-and-array-types-are-splittable-field-value-is-of-type-nilclass/213154 "2019-12-27T08:11:08Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![exilemirror](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/exilemirror/32/45323_2.png) [@exilemirror](https://discuss.elastic.co/u/exilemirror)\
**Post date:** [December 27, 2019, 8:11am UTC](https://discuss.elastic.co/t/split-only-string-and-array-types-are-splittable-field-value-is-of-type-nilclass/213154/1 "2019-12-27T08:11:08Z")

</div>

Hi I'm trying to filter a JSON file extracted from Microsoft Graph API.  
JSON file content below.

{  
"@odata.context": "[https://microsoft.com](https://microsoft.com)",  
"value": [  
{  
"currentScore": 203.0,  
"maxScore": 802.0,  
"createdDateTime": "2019-12-26T00:00:00Z"  
},  
{  
"currentScore": 203.0,  
"maxScore": 802.0,  
"createdDateTime": "2019-12-25T00:00:00Z"  
}  
]  
}

Having issue pulling out the currentScore, maxScore & createdDateTime data. Getting split - Only String and Array types are splittable. field:[value] is of type = NilClass error.

My test config is below. Having a hard time figuring out on how to use the split under filter section. Your help is much appreciated.

input {  
stdin {  
codec =\> json  
}  
}

filter {  
split {  
field =\> "[value]"  
}  
mutate {  
add\_field =\> {  
"currentScore" =\> "%{[value][currentScore]}"  
"maxScore" =\> "%{[value][maxScore]}"  
"createdDateTime" =\> "%{[value][createdDateTime]}"  
}  
update =\> { "host" =\> "Microsoft Graph" }  
remove\_field =\> ["@version","createdDateTime"]  
}  
date {  
match =\> ["createdDateTime", "ISO8601"]  
target =\> "@timestamp"  
}  
}

output {  
stdout {  
codec =\> rubydebug  
}  
}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 24, 2020, 8:11am UTC](https://discuss.elastic.co/t/split-only-string-and-array-types-are-splittable-field-value-is-of-type-nilclass/213154/2 "2020-01-24T08:11:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.