# Substring record basing on numerical index

**URL:** https://discuss.elastic.co/t/substring-record-basing-on-numerical-index/209286
**Category:** Logstash
**Tags:** elastic-stack-sql
**Created:** [November 25, 2019, 10:51am UTC](https://discuss.elastic.co/t/substring-record-basing-on-numerical-index/209286 "2019-11-25T10:51:20Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![sam.cook](https://avatars.discourse-cdn.com/v4/letter/s/57b2e6/32.png) [@sam.cook](https://discuss.elastic.co/u/sam.cook)
#### Post date: [November 25, 2019, 10:51am UTC](https://discuss.elastic.co/t/substring-record-basing-on-numerical-index/209286/1 "2019-11-25T10:51:20Z")

</div>

Hi everyone,  
my logstash config file is as follows

```auto
input {
	jdbc {
		jdbc_connection_string => "Connection String"
		jdbc_driver_class => "com.microsoft.sqlserver.jdbc.SQLServerDriver"
		jdbc_user => "User"
		jdbc_driver_library => "Lib Path"
		schedule => "*/5 * * * *"
		
		statement => "SELECT uid, date, idstation FROM tablr 1ORDER BY uid ASC"
		use_column_value => true
		tracking_column => "uid"
		tracking_column_type => "numeric"
		clean_run => true
		last_run_metadata_path => "data\.logstash_jdbc_last_run"
	}
}

filter { ... }

output { ... }

```

`idstation` field is formed by 8 characters (e.g. 02030417). I want to split this field into four other fields, the criteria of splitting is that every subfield found is formed by two characters, in this case the first field is 02, the second 03, the third 04 and the fourth 17. After splitting, i want this four field to be added into elasticsearch into four separated fields, because i need to make searches basing on each individual field.

I cannot find the way to do this, please help me, thank you in advance!

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [November 25, 2019, 2:19pm UTC](https://discuss.elastic.co/t/substring-record-basing-on-numerical-index/209286/2 "2019-11-25T14:19:13Z")

</div>

You can use mutate+gsub to capture fixed length substrings. See [this](https://discuss.elastic.co/t/problem-with-split-and-add-field-in-mutate-filter/208883/4).

---

<div class="post-metadata">

### Author: ![sam.cook](https://avatars.discourse-cdn.com/v4/letter/s/57b2e6/32.png) [@sam.cook](https://discuss.elastic.co/u/sam.cook)
#### Post date: [November 27, 2019, 8:12am UTC](https://discuss.elastic.co/t/substring-record-basing-on-numerical-index/209286/3 "2019-11-27T08:12:04Z")

</div>

Thank you Badger for your response. For me it worked to use Ruby filter.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 25, 2019, 8:12am UTC](https://discuss.elastic.co/t/substring-record-basing-on-numerical-index/209286/4 "2019-12-25T08:12:19Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.