# Split string into array and then into key value pairs

**URL:** https://discuss.elastic.co/t/split-string-into-array-and-then-into-key-value-pairs/264741
**Category:** Logstash
**Created:** [February 18, 2021, 5:21pm UTC](https://discuss.elastic.co/t/split-string-into-array-and-then-into-key-value-pairs/264741 "2021-02-18T17:21:49Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![edster](https://avatars.discourse-cdn.com/v4/letter/e/da6949/32.png) [@edster](https://discuss.elastic.co/u/edster)
#### Post date: [February 18, 2021, 5:21pm UTC](https://discuss.elastic.co/t/split-string-into-array-and-then-into-key-value-pairs/264741/1 "2021-02-18T17:21:49Z")

</div>

Is there a way to split a string into an array and then turn each of those values into key value pairs within the array using logstash.

For example:  
Turning this:  
SomeField -\> "key1:value1;key2:value2;key3:value3"

Into:  
"SomeField": [  
{  
"key": "key1",  
"value": "value1"  
},  
{  
"key": "key2",  
"value": "value2"  
},  
{  
"key": "key3",  
"value": "value3"  
}  
]

I've tried using kv filter but it doesn't quite do this.

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [February 18, 2021, 6:46pm UTC](https://discuss.elastic.co/t/split-string-into-array-and-then-into-key-value-pairs/264741/2 "2021-02-18T18:46:45Z")

</div>

I would do that using ruby.

```
    ruby {
        code => '
            x = event.get("SomeField")
            if x
                a = []
                x.split(";").each { |y|
                    z = y.split(":")
                    a << { "key" => z[0], "value" => z[1] }
                }
            end
            event.set("SomeField", a)
        '
    }
```

---

<div class="post-metadata">

### Author: ![edster](https://avatars.discourse-cdn.com/v4/letter/e/da6949/32.png) [@edster](https://discuss.elastic.co/u/edster)
#### Post date: [February 18, 2021, 7:06pm UTC](https://discuss.elastic.co/t/split-string-into-array-and-then-into-key-value-pairs/264741/3 "2021-02-18T19:06:18Z")

</div>

yes this worked. thank you. The previous mutate split option was not needed.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 18, 2021, 7:07pm UTC](https://discuss.elastic.co/t/split-string-into-array-and-then-into-key-value-pairs/264741/4 "2021-03-18T19:07:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.