# Split source value and create a custom field with splitted one

**URL:** <https://discuss.elastic.co/t/split-source-value-and-create-a-custom-field-with-splitted-one/110334>\
**Category:** Logstash\
**Created:** [December 5, 2017, 12:02pm UTC](https://discuss.elastic.co/t/split-source-value-and-create-a-custom-field-with-splitted-one/110334 "2017-12-05T12:02:10Z")\
**Posts on this page:** 1\
**Showing post:** 5

<div class="post-metadata">

**Author:** ![platso588](https://avatars.discourse-cdn.com/v4/letter/p/dec6dc/32.png) [@platso588](https://discuss.elastic.co/u/platso588)\
**Post date:** [December 5, 2017, 1:37pm UTC](https://discuss.elastic.co/t/split-source-value-and-create-a-custom-field-with-splitted-one/110334/5 "2017-12-05T13:37:54Z")

</div>

This resolved the Issue and Thanks a ton 👌

Working code snippets for both the approaches.

**1. copy of source by creating a temp variable,**

```
	if ([fields][log_type] == "yarnHive2kafkaLog") {
    grok {
            match => { "message" => "%{YEAR:logYear}-%{MONTHNUM:logMonth}-%{MONTHDAY:logDate} %{TIME:logTime} \!%{SPACE}%{LOGLEVEL:logLevel}%{SPACE}\! %{GREEDYDATA:message}"}
         }
    mutate {
            copy => { "source" => "source_tmp" }
           }
    mutate {
            split => ["source_tmp", "/"]
            add_field => { "applicationID" => "%{source_tmp[4]}" }
           }                       
            }  

```

**2. grok filter on source**

```
	if ([fields][log_type] == "yarnHive2kafkaLog") {
    grok {
            match => { "message" => "%{YEAR:logYear}-%{MONTHNUM:logMonth}-%{MONTHDAY:logDate} %{TIME:logTime} \!%{SPACE}%{LOGLEVEL:logLevel}%{SPACE}\! %{GREEDYDATA:message}"}
         }
    grok {
            match => { "source" => "/%{GREEDYDATA:primaryDir}/%{GREEDYDATA:subDir1}/%{GREEDYDATA:subDir2}/%{GREEDYDATA:subDir3}/%{GREEDYDATA:containerID}/%{GREEDYDATA:fileName}"}
            }
    mutate {
           add_field => { "applicationID" => "%{subDir3}" }
           }                       
            }
```

---

_[View the full topic](https://discuss.elastic.co/t/split-source-value-and-create-a-custom-field-with-splitted-one/110334)._