# Spliting the field

**URL:** <https://discuss.elastic.co/t/spliting-the-field/192191>\
**Category:** Logstash\
**Created:** [July 25, 2019, 7:31am UTC](https://discuss.elastic.co/t/spliting-the-field/192191 "2019-07-25T07:31:54Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Raj\_Kumar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/raj_kumar/32/25420_2.png) [@Raj\_Kumar](https://discuss.elastic.co/u/Raj_Kumar)\
**Post date:** [July 25, 2019, 7:31am UTC](https://discuss.elastic.co/t/spliting-the-field/192191/1 "2019-07-25T07:31:54Z")

</div>

Hi There,

I have a field called SE\_Payload.SE\_SysStatsUtilizationDiskSpace and it gives me lot of useful information, but I dont know to how to split these in to different values like

SE\_Payload.SE\_SysStatsUtilizationDiskSpace\_parent: 0.17

SE\_Payload.SE\_SysStatsUtilizationDiskSpace\_boot: 0.25

SE\_Payload.SE\_SysStatsUtilizationDiskSpace\_tmp: 0.01

something like this ,so I can create visualization with gauges showing utilisation but I dont know how to do it

SE\_Payload.SE\_SysStatsUtilizationDiskSpace: 17% /, 25% /boot, 1% /tmp, 2% /storedconfig, 9% /opt, 3% /localdisk, 9% /opt/docker/runtime/overlay

And am not sure if the all the fields will have same value , some time it changes like some fileds will have only boot and tmp , some have boot and opt .

Could any one please help me out.

Thanks,  
Raj

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 25, 2019, 1:45pm UTC](https://discuss.elastic.co/t/spliting-the-field/192191/2 "2019-07-25T13:45:33Z")

</div>

> [@Raj\_Kumar](#):
>
> SE\_Payload.SE\_SysStatsUtilizationDiskSpace: 17% /, 25% /boot, 1% /tmp, 2% /storedconfig, 9% /opt, 3% /localdisk, 9% /opt/docker/runtime/overlay

You have value/key pairs there, so although a kv filter will parse it, the results are ugly. I would use ruby

```
    grok { match => { "message" => ": %{GREEDYDATA:disks}" } }
    ruby {
        code => '
            m = event.get("disks").scan(/([0-9]+)% ([^,]*)/)
            m.each { |x|
                event.set("[someField][#{x[1]}]", x[0].to_i)
            }
        '
    }

```

which produces

```
 "someField" => {
                  "/storedconfig" => 2,
                           "/opt" => 9,
    "/opt/docker/runtime/overlay" => 9,
                              "/" => 17,
                          "/boot" => 25,
                     "/localdisk" => 3,
                           "/tmp" => 1
}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 22, 2019, 1:45pm UTC](https://discuss.elastic.co/t/spliting-the-field/192191/3 "2019-08-22T13:45:34Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.