# Using custom analyzer / tokenizers to breakdown a string into subfields

**URL:** <https://discuss.elastic.co/t/using-custom-analyzer-tokenizers-to-breakdown-a-string-into-subfields/58918>\
**Category:** Elasticsearch\
**Created:** [August 25, 2016, 10:43am UTC](https://discuss.elastic.co/t/using-custom-analyzer-tokenizers-to-breakdown-a-string-into-subfields/58918 "2016-08-25T10:43:52Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![feicipet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/feicipet/32/8056_2.png) [@feicipet](https://discuss.elastic.co/u/feicipet)\
**Post date:** [August 25, 2016, 10:43am UTC](https://discuss.elastic.co/t/using-custom-analyzer-tokenizers-to-breakdown-a-string-into-subfields/58918/1 "2016-08-25T10:43:52Z")

</div>

Hi,

I am getting a CSV report of PC specifications which I'm using logstash to import into ES.

One of the fields in the report that I receive comes in the following format:

`C: (Used '14.51'GB of '80.01'GB , '18.13'%), D: (Used '42.42'GB of '385.75'GB , '11'%)`

The number of drives is dynamic, depending on number of drives in the user's PC.

Instead of just storing this string, I would like to be able to store it in the following format:

```
"disks": [
	{
		"drivename": "C",
		"used": "14.51",
		"size": "80.01",
		"remaining": "65.5" #needs to be calculated
		"percentage": "18.13"
	},
	{
		"drivename": "D",
		"used": "42.42",
		"size": "385.75",
		"remaining": "343.33" #needs to be calculated
		"percentage": "11"
	}
]

```

I think it can be done by defining the `disks` field to use a custom analyzer and using a `pattern` tokenizer to breakdown the analyzer but the examples I find in the documentation is too simple for me to make much headway. Is there a more complex example that splits a string into multiple fields where I can refer to?

If anyone thinks that there's a better way to do this, I'm all ears too.

Thank you!  
Wong

---

<div class="post-metadata">

**Author:** ![ywelsch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ywelsch/32/7751_2.png) [@ywelsch](https://discuss.elastic.co/u/ywelsch)\
**Post date:** [August 25, 2016, 11:08am UTC](https://discuss.elastic.co/t/using-custom-analyzer-tokenizers-to-breakdown-a-string-into-subfields/58918/2 "2016-08-25T11:08:13Z")

</div>

As you are using Logstash to do the import, the simplest way is to do the conversion into the desired format there:

[https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html](https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 10:25pm UTC](https://discuss.elastic.co/t/using-custom-analyzer-tokenizers-to-breakdown-a-string-into-subfields/58918/3 "2017-07-05T22:25:15Z")

</div>