# Split type failure Logstash

**URL:** <https://discuss.elastic.co/t/split-type-failure-logstash/339594>\
**Category:** Logstash\
**Created:** [July 29, 2023, 11:32am UTC](https://discuss.elastic.co/t/split-type-failure-logstash/339594 "2023-07-29T11:32:46Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Bharat\_Lahori](https://avatars.discourse-cdn.com/v4/letter/b/dc4da7/32.png) [@Bharat\_Lahori](https://discuss.elastic.co/u/Bharat_Lahori)\
**Post date:** [July 29, 2023, 11:32am UTC](https://discuss.elastic.co/t/split-type-failure-logstash/339594/1 "2023-07-29T11:32:46Z")

</div>

Dear Team,

I have configured below logstash conf file . Trying to give stdin input and getting an error as split type failure. PFB details. We need to create two events based on metricValues.

Conf file

```auto
 input {
  stdin {
    codec => multiline {
       pattern => "^\s+"
       negate => false
       what => previous
       max_lines => 20000
    }
  }
}
filter {
json {
    source => "message"
    target => "message"
  }
split {
  field => "metricValues"
 }
}
output {  
  stdout {
  codec => rubydebug
 }
 file {
    path => ['D:\Test_bh.log']
    flush_interval => 0
  }
} 

Input which we give is as below
[{"metricId":2402666,
  "frequency":11,
 "metricValues":[
 { "startTimeInMillis":1690194000000,
  "occurrences":1,
  "current":0,
 "min":0,
 "max":0,
 "useRange":true,
  "count":0,
 "sum":0,
 "value":0,
 "standardDeviation":0
 },
 { "startTimeInMillis":1690194600000,
 "occurrences":1,
 "current":225,
  "min":225,
 "max":225,
 "useRange":true,
  "count":1,
 "sum":225,
 "value":225,
  "standardDeviation":0
 }]}]

Output

Output is as below
[2023-07-29T16:51:01,939][WARN][logstash.filters.split][main][ca0090ef804b41fc1df4d0784f800741445dcd67fa8a0ea934a4f2750782052c] Only String and Array types are splittable. field:metricValues is of type = NilClass
{
          "tags" => [
        [0] "multiline",
        [1] "_split_type_failure"
    ],
       "message" => [
        [0] {
            "metricValues" => [
                [0] {
                          "occurrences" => 1,
                              "current" => 0,
                                "value" => 0,
                                "count" => 0,
                                  "min" => 0,
                    "startTimeInMillis" => 1690194000000,
                                  "max" => 0,
                             "useRange" => true,
                                  "sum" => 0,
                    "standardDeviation" => 0
                },
                [1] {
                          "occurrences" => 1,
                              "current" => 225,
                                "value" => 225,
                                "count" => 1,
                                  "min" => 225,
                    "startTimeInMillis" => 1690194600000,
                                  "max" => 225,
                             "useRange" => true,
                                  "sum" => 225,
                    "standardDeviation" => 0
                }
            ],
               "frequency" => 11,
                "metricId" => 2402666
        }
    ],
      "@version" => "1",
    "@timestamp" => 2023-07-29T11:21:01.529Z,
          "host" => "QKNBK2376"
}
[2023-07-29T16:51:02,352][INFO][logstash.outputs.file][main][ebc807caeda4cc022d5b5b5164e0e1a57d52389da2b1cb505de9aa8cd988c7dd] Opening file {:path=>"D:/Test_bh.log"}
[2023-07-29T16:51:23,735][INFO][logstash.outputs.file][main][ebc807caeda4cc022d5b5b5164e0e1a57d52389da2b1cb505de9aa8cd988c7dd] Closing file D:/Test_bh.log

Please suggest.

Regards,
Bharat
or paste code here

```

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [July 29, 2023, 1:05pm UTC](https://discuss.elastic.co/t/split-type-failure-logstash/339594/2 "2023-07-29T13:05:04Z")

</div>

> [@Bharat\_Lahori](#):
>
> ```auto
> json {
> source => "message"
> target => "message"
> }
> 
> ```

You are using a target in the json filter, so the content of your json will be under the `message` field, you will do not have a field named `metricValues` on the root of your document, you have a field named `metricValues` inside the json object `messages`.

In logstash the correct way to reference this field would be `[messages][metricValues]`

Also, if you look at your output your `message` is also an array, so you would need another split filter on this field.

Something like this:

```auto
split {
   field => "message"
}
split {
    field => "[message][metricValues]"
}

```

---

<div class="post-metadata">

**Author:** ![Bharat\_Lahori](https://avatars.discourse-cdn.com/v4/letter/b/dc4da7/32.png) [@Bharat\_Lahori](https://discuss.elastic.co/u/Bharat_Lahori)\
**Post date:** [July 29, 2023, 5:58pm UTC](https://discuss.elastic.co/t/split-type-failure-logstash/339594/3 "2023-07-29T17:58:16Z")

</div>

Hi Leandro,

Your solution worked. Thanks for your help.

Regards,

Bharat

 ![98C3111F5EC34212A213AF17163FA3F8.png](https://us1.discourse-cdn.com/elastic/original/3X/2/e/2e839751fd263c2803de1577258c08f5c6235600.png)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 26, 2023, 5:58pm UTC](https://discuss.elastic.co/t/split-type-failure-logstash/339594/4 "2023-08-26T17:58:45Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.