# Split text field into array
**URL:** https://discuss.elastic.co/t/split-text-field-into-array/104797
**Category:** Logstash
**Created:** [October 22, 2017, 10:41am UTC](https://discuss.elastic.co/t/split-text-field-into-array/104797 "2017-10-22T10:41:58Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@yosi](https://discuss.elastic.co/u/yosi)
#### Post date: [October 22, 2017, 10:41am UTC](https://discuss.elastic.co/t/split-text-field-into-array/104797/1 "2017-10-22T10:41:58Z")
Hey guys, i'm new in ELK and i'm trying to figure how to split my field into an array .
json input looks like this :
{
{
"ID":"1",
"FilesByProcess":"C:\Windows\system32\taskhost.exe:100;C:\Windows\system32\cmd.exe:10",
"another\_field":"xxx"
}
{
"ID":"2",
"FilesByProcess":"C:\Windows\system32\taskhost.exe:150;C:\Windows\system32\cmd.exe:600",
"another\_field":"xxx"
}
{
"ID":"1",
"FilesByProcess":"C:\Windows\system32\cmd.exe:10;C:\Windows\system32\svchost.exe:20",
"another\_field":"xxx"
}
}
- FilesByProcess can have multiple values splited by -";"
- i want to filter by ID and files by process , for example for id -1 i want to see the how many files modified by taskhost.exe(110)
I've looked for some answers and i try Split Process but i dont see any results on the kibana
"split": {
"field": "FilesByProcess",
"separator": ";"
}
also i tried mutate filter plugin filter {
mutate {
split =\> { "FilesByProcess" =\> ";" }
}
}
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [October 23, 2017, 6:14am UTC](https://discuss.elastic.co/t/split-text-field-into-array/104797/2 "2017-10-23T06:14:36Z")
Show an example event. Copy/Paste from Kibana's JSON tab.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 20, 2017, 6:15am UTC](https://discuss.elastic.co/t/split-text-field-into-array/104797/3 "2017-11-20T06:15:15Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.