# Splitting table based on text value

**URL:** <https://discuss.elastic.co/t/splitting-table-based-on-text-value/312208>\
**Category:** Kibana\
**Created:** [August 16, 2022, 5:39pm UTC](https://discuss.elastic.co/t/splitting-table-based-on-text-value/312208 "2022-08-16T17:39:46Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Marius\_Kunauskas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_kunauskas/32/98686_2.png) [@Marius\_Kunauskas](https://discuss.elastic.co/u/Marius_Kunauskas)\
**Post date:** [August 16, 2022, 5:39pm UTC](https://discuss.elastic.co/t/splitting-table-based-on-text-value/312208/1 "2022-08-16T17:39:46Z")

</div>

As a complete elastic-newbie, how could I split a column based on its text value?  
I.e. Instead of splitting rows on different Field values (e.g. country), I want to split it based on WHETHER a field starts with a certain combination of letters, or not. Hope that makes sense.

---

<div class="post-metadata">

**Author:** ![rugenl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rugenl/32/12887_2.png) [@rugenl](https://discuss.elastic.co/u/rugenl)\
**Post date:** [August 16, 2022, 6:37pm UTC](https://discuss.elastic.co/t/splitting-table-based-on-text-value/312208/2 "2022-08-16T18:37:16Z")

</div>

You can probably do that in an ingest pipeline, with the [split](https://www.elastic.co/guide/en/elasticsearch/reference/8.3/split-processor.html) processor and a  
[conditional (example)](https://www.elastic.co/guide/en/elasticsearch/reference/8.3/ingest.html#conditionally-run-processor)

This part of the example

> "if": "ctx.url?.scheme =~ /^http[^s]/"

uses regexp similar to what you're asking.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 13, 2022, 6:37pm UTC](https://discuss.elastic.co/t/splitting-table-based-on-text-value/312208/3 "2022-09-13T18:37:52Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
