# Split value in logstash

**URL:** <https://discuss.elastic.co/t/split-value-in-logstash/119019>\
**Category:** Logstash\
**Created:** [February 8, 2018, 10:44am UTC](https://discuss.elastic.co/t/split-value-in-logstash/119019 "2018-02-08T10:44:25Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![youssef](https://avatars.discourse-cdn.com/v4/letter/y/df788c/32.png) [@youssef](https://discuss.elastic.co/u/youssef)\
**Post date:** [February 8, 2018, 10:44am UTC](https://discuss.elastic.co/t/split-value-in-logstash/119019/1 "2018-02-08T10:44:25Z")

</div>

Hi all,

i have field called CONGESTION\_LEVEL that may contain the values 0 , 1 , 2 , 0;N , 1;N , 2;N or may be empty, i want to add integer field that may contain 0 ,1 ,2 values:  
if the CONGESTION\_LEVEL field is 0 1 or 2 then no change on the value  
if the CONGESTION\_LEVEL field is 0:N 1;N or 2:N then i need to split it and stay with only the number  
else the new field will contain the vaue 0  
i am using Logstash 6.0

input {  
file {  
path =\> "/var/log/Optimize/reports/transactionsLog/transaction.log.402"  
start\_position =\> "beginning"  
}  
}  
filter {  
csv {  
separator =\> " "  
columns =\> ["START\_TIME", "END\_TIME","CONTENT\_TYPE", "UPSTREAM\_SIZE","DOWNSTREAM\_SIZE","NUMBER\_OF\_STALLS", "CONGESTION\_LEVEL"]  
convert =\> {  
"UPSTREAM\_SIZE" =\> "integer"  
"DOWNSTREAM\_SIZE" =\> "integer"  
"NUMBER\_OF\_STALLS" =\> "integer"  
"AVERAGE\_STALLS\_LENGTH" =\> "integer"  
"CONGESTION\_LEVEL" =\> "integer"  
"START\_TIME" =\> "date"  
"END\_TIME" =\> "date"  
}  
}  
}  
filter{  
if ([CONGESTION\_LEVEL]) and (([CONGESTION\_LEVEL])\>-1) and ([CONGESTION\_LEVEL]\<3){  
ruby {  
code =\> "event.set('CONGESTION\_LEVEL\_NEW', event.get('CONGESTION\_LEVEL'))"  
}  
}else if ";" in [CONGESTION\_LEVEL]{  
ruby {  
code =\> "event.set('CONGESTION\_LEVEL\_NEW', event.get('CONGESTION\_LEVEL')[0..1])"  
}  
}else{  
ruby {  
code =\> "event.set('CONGESTION\_LEVEL\_NEW', 0)"  
}  
}  
}

output {  
elasticsearch  
{  
hosts =\> ["localhost:9200"]  
}  
}

Regards,  
Yoskaly

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 8, 2018, 11:20am UTC](https://discuss.elastic.co/t/split-value-in-logstash/119019/2 "2018-02-08T11:20:55Z")

</div>

You can use the gsub option of a mutate filter to remove ";N" from the end of the string. You also need a conditional wrapping a mutate filter to set the field value to zero if the field is empty.

---

<div class="post-metadata">

**Author:** ![paz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/paz/32/28003_2.png) [@paz](https://discuss.elastic.co/u/paz)\
**Post date:** [February 8, 2018, 11:21am UTC](https://discuss.elastic.co/t/split-value-in-logstash/119019/3 "2018-02-08T11:21:51Z")

</div>

Your logic seems fine, but you're making it a bit more convoluted than needed. This should work (since you're using inline Ruby anyway).

```auto
filter {
    ruby {
        code => "
            event.get('CONGESTION_LEVEL')[0].to_i < 3 ? event.set('CONGESTION_LEVEL', event.get('CONGESTION_LEVEL')[0].to_i) : 0
        "
    }
}
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 8, 2018, 11:21am UTC](https://discuss.elastic.co/t/split-value-in-logstash/119019/4 "2018-03-08T11:21:53Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.