# Spliting the field

**URL:** https://discuss.elastic.co/t/spliting-the-field/192191
**Category:** Logstash
**Created:** [July 25, 2019, 7:31am UTC](https://discuss.elastic.co/t/spliting-the-field/192191 "2019-07-25T07:31:54Z")
**Posts on this page:** 1
**Showing post:** 2

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [July 25, 2019, 1:45pm UTC](https://discuss.elastic.co/t/spliting-the-field/192191/2 "2019-07-25T13:45:33Z")

</div>

> [@Raj\_Kumar](#):
>
> SE\_Payload.SE\_SysStatsUtilizationDiskSpace: 17% /, 25% /boot, 1% /tmp, 2% /storedconfig, 9% /opt, 3% /localdisk, 9% /opt/docker/runtime/overlay

You have value/key pairs there, so although a kv filter will parse it, the results are ugly. I would use ruby

```
    grok { match => { "message" => ": %{GREEDYDATA:disks}" } }
    ruby {
        code => '
            m = event.get("disks").scan(/([0-9]+)% ([^,]*)/)
            m.each { |x|
                event.set("[someField][#{x[1]}]", x[0].to_i)
            }
        '
    }

```

which produces

```
 "someField" => {
                  "/storedconfig" => 2,
                           "/opt" => 9,
    "/opt/docker/runtime/overlay" => 9,
                              "/" => 17,
                          "/boot" => 25,
                     "/localdisk" => 3,
                           "/tmp" => 1
}

```

---

_[View the full topic](https://discuss.elastic.co/t/spliting-the-field/192191)._