split

The split filter clones an event by splitting one of its fields and placing each value resulting from the split into a clone of the original event. The field being split can either be a string or an array.

An example use case of this filter is for taking output from the exec input plugin which emits one event for the whole output of a command and splitting that output by newline - making each line an event.

The end result of each split is a complete copy of the event with only the current split section of the given field changed.

Synopsys

split {
}

Available settings

Setting Type Info Default value
field string ""
target string ""
terminator string ""

Common Options

Details

field

  • Value type is string
  • Default value is ""
  • The field which value is split by the terminator

    target

  • Value type is string
  • Default value is ""
  • The field within the new event which the value is split into. If not set, target field defaults to split field name

    terminator

  • Value type is string
  • Default value is ""
  • The string to split on. This is usually a line terminator, but can be any string Default value is “\n”

    Full configuration blueprint

    Expand me...