# Splitting a field that looks like an array **URL:** \ **Category:** Logstash\ **Created:** [October 9, 2024, 2:48pm UTC](https://discuss.elastic.co/t/splitting-a-field-that-looks-like-an-array/368540 "2024-10-09T14:48:40Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![cdy5159](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cdy5159/32/115812_2.png) [@cdy5159](https://discuss.elastic.co/u/cdy5159)\ **Post date:** [October 9, 2024, 2:48pm UTC](https://discuss.elastic.co/t/splitting-a-field-that-looks-like-an-array/368540/1 "2024-10-09T14:48:40Z")
I'm getting audit data from my linux hosts that will sometimes repeat a field name, so I get what looks like an array of data in that field. I've tried various forms of 'split' to see if I can separate the data into two different fields, but so far no luck. Here's the data: "auditd.log": { "subj": "system\_u:system\_r:sshd\_t:s0-s0:c0.c1023", "UID": "root", "AUID": "haliburtonj", "SUID": "haliburtonj", "auid": "609443", "uid": "0", "msg": [ "audit(1728476586.530:1812440):", "op=destroy kind=session fp=? direction=from-server spid=475218 suid=609443 rport=52032 laddr=X.X.X.Xlport=22 exe="/usr/sbin/sshd" hostname=? addr=X.X.X.X terminal=? res=success" ], "type": "CRYPTO\_KEY\_USER", "pid": "475148", "ses": "406" }, I want to separate the auditd.log.msg field. The second field I'd like to be able to run thru KV. I've tried this - `mutate { convert => { "[auditd][log][auditmsg]" => "string" } split => { field => "[auditd][log][msg]" } add_field => { "[auditd][log][auditid]" => "%{[auditd][log][msg][0]}" "[auditd][log][auditmesg]" => "%{[auditd][log][msg][1]}" } }` but all this does is assign audltd.log.auditid = "%{[auditd][log][msg][0]}" literally. Any suggestions? ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [October 9, 2024, 3:09pm UTC](https://discuss.elastic.co/t/splitting-a-field-that-looks-like-an-array/368540/2 "2024-10-09T15:09:50Z")
> [@cdy5159](#): > > convert =\> { "[auditd][log][auditmsg]" =\> "string" } Shoudn't that be "[auditd][log][msg]"? A mutate filter does operations in a fixed order. Luckily convert comes before split and add\_field happens at the end, so using one mutate for all of these operations should work. ---
**Author:** ![cdy5159](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cdy5159/32/115812_2.png) [@cdy5159](https://discuss.elastic.co/u/cdy5159)\ **Post date:** [October 9, 2024, 3:15pm UTC](https://discuss.elastic.co/t/splitting-a-field-that-looks-like-an-array/368540/3 "2024-10-09T15:15:48Z")
Typo on my part. Yes, auditmsg should just be msg. Still has same output. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [October 9, 2024, 3:24pm UTC](https://discuss.elastic.co/t/splitting-a-field-that-looks-like-an-array/368540/4 "2024-10-09T15:24:16Z")
The mutate+convert converts the msg field from an array to a string. The mutate+split then converts it back to an array. It doesn't do anything. Perhaps the underlying issue is that the field you have is actually called [audit.log][msg], in which case the convert and split are currently no-ops (the fields they operate on do not exist) and the add\_field will not modify the references to non-existent fields. Try ``` mutate { add_field => { "[auditd.log][auditid]" => "%{[auditd.log][msg][0]}" "[auditd.log][auditmesg]" => "%{[auditd.log][msg][1]}" } } } ``` ---
**Author:** ![cdy5159](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cdy5159/32/115812_2.png) [@cdy5159](https://discuss.elastic.co/u/cdy5159)\ **Post date:** [October 9, 2024, 3:57pm UTC](https://discuss.elastic.co/t/splitting-a-field-that-looks-like-an-array/368540/5 "2024-10-09T15:57:56Z")
Still getting - auditd.log.auditid literally = "%{[auditd.log][msg][0]}" auditd.log.auditmesg literally = "%{[auditd.log][msg][1]}" ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [October 9, 2024, 4:24pm UTC](https://discuss.elastic.co/t/splitting-a-field-that-looks-like-an-array/368540/6 "2024-10-09T16:24:30Z")
Try using ``` output { stdout { codec => rubydebug } } ``` and show us what the event looks like. ---
**Author:** ![cdy5159](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cdy5159/32/115812_2.png) [@cdy5159](https://discuss.elastic.co/u/cdy5159)\ **Post date:** [October 9, 2024, 4:38pm UTC](https://discuss.elastic.co/t/splitting-a-field-that-looks-like-an-array/368540/7 "2024-10-09T16:38:13Z")
"auditd.log" =\> { "a1" =\> "c0006be10c", "exe" =\> "/usr/bin/podman", "sgid" =\> "70000", "ARCH" =\> "x86\_64", "ses" =\> "7", "SUID" =\> "yoosr", "a3" =\> "0", "FSGID" =\> "engineering", "tty" =\> "none", "egid" =\> "70000", "suid" =\> "11638518", "auditid" =\> "%{[auditd][log][msg][0]}", "UID" =\> "yoosr", "node" =\> "sweetwater.u.l3", "type" =\> "SYSCALL", "arch" =\> "c000003e", "items" =\> "2", "syscall" =\> "263", "msg" =\> "audit(1728489445.008:50936455):", "auid" =\> "11638518", "uid" =\> "11638518", "euid" =\> "11638518", "exit" =\> "0", "ppid" =\> "69476", "comm" =\> "podman", "a0" =\> "a", "subj" =\> "unconfined\_u:unconfined\_r:container\_runtime\_t:s0-s0:c0.c1023", "a2" =\> "0", "SYSCALL" =\> "unlinkat", "key" =\> "delete", "gid" =\> "70000", "fsgid" =\> "70000", "AUID" =\> "yoosr", "GID" =\> "engineering", "EUID" =\> "yoosr", "success" =\> "yes", "FSUID" =\> "yoosr", "pid" =\> "2837330", "EGID" =\> "engineering", "SGID" =\> "engineering", "fsuid" =\> "11638518", "auditmesg" =\> "%{[auditd][log][msg][1]}" ---
**Author:** ![cdy5159](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cdy5159/32/115812_2.png) [@cdy5159](https://discuss.elastic.co/u/cdy5159)\ **Post date:** [October 9, 2024, 4:45pm UTC](https://discuss.elastic.co/t/splitting-a-field-that-looks-like-an-array/368540/8 "2024-10-09T16:45:30Z")
Found the problem, too many square brackets under add\_field. "[auditd][log][msg]" should be "[audit.log][msg]" "[auditd][log][auditid]" should be "[auditd.log][auditid]" "[auditd][log][auditmesg]" should be '"[auditd.log][auditmesg]"