Split

Mutate Elastic Compatible

Synopsis

Splits a string field into an array using a specified separator pattern.

Schema

- split:
    field: <ident>
    separator: <char>
    description: <text>
    if: <script>
    ignore_failure: <boolean>
    ignore_missing: <boolean>
    on_failure: <processor[]>
    on_success: <processor[]>
    preserve_trailing: <boolean>
    tag: <string>
    target_field: <ident>

Configuration

The following fields are used to define the processor:

Field	Required	Default	Description
field	Y	-	Field containing the string to split
separator	Y	-	Character or regular expression pattern to use as separator
description	N	-	Explanatory note
if	N	-	Condition to run
ignore_failure	N	false	See Handling Failures
ignore_missing	N	false	If true, quietly exit if field doesn't exist
on_failure	N	-	See Handling Failures
on_success	N	-	See Handling Success
preserve_trailing	N	false	If true, preserve empty trailing values
tag	N	-	Identifier
target_field	N	field	Field to store the resulting array

Details

When splitting strings, the processor supports both basic string separators and advanced regular expression patterns. The result is stored as an array either in the original field or in a specified target field.

note

Regular expressions are cached for better performance when reused.

warning

The field must contain a string value, otherwise the processor will fail unless ignore_failure is set to true.

Examples

Basic

Split string using comma separator...	{ "data": "one,two,three" } - split: field: data separator: ","
to create an array of values:	{ "data": ["one", "two", "three"] }

Trailing Values

Enabling preserve_trailing...	{ "data": "one,two,three," } - split: field: data separator: "," preserve_trailing: true
keeps empty trailing elements:	{ "data": ["one", "two", "three", ""] }

Regular Expressions

Splitting on multiple whitespace characters...	{ "message": "hello world test" } - split: field: message separator: '\s+'
treats consecutive spaces as one separator:	{ "message": ["hello", "world", "test"] }

Keep Original

Storing the result in a new field...	{ "tags": "important,urgent,review" } - split: field: tags separator: "," target_field: tag_array
preserves the original:	{ "tags": "important,urgent,review", "tag_array": ["important", "urgent", "review"] }