Split processor
Splits a field into an array using a separator character. Only works on string fields.
Table 39. Split Options
| Name | Required | Default | Description |
|---|---|---|---|
| yes | - | The field to split |
| yes | - | A regex which matches the separator, eg |
| no |
| The field to assign the split value to, by default |
| no |
| If |
| no |
| Preserves empty trailing fields, if any. |
| no | - | Description of the processor. Useful for describing the purpose of the processor or its configuration. |
| no | - | Conditionally execute the processor. See Conditionally run a processor. |
| no |
| Ignore failures for the processor. See Handling pipeline failures. |
| no | - | Handle failures for the processor. See Handling pipeline failures. |
| no | - | Identifier for the processor. Useful for debugging and metrics. |
{
"split": {
"field": "my_field",
"separator": "\\s+"
}
} | Treat all consecutive whitespace characters as a single separator |
If the preserve_trailing option is enabled, any trailing empty fields in the input will be preserved. For example, in the configuration below, a value of A,,B,, in the my_field property will be split into an array of five elements ["A", "", "B", "", ""] with two empty trailing fields. If the preserve_trailing property were not enabled, the two empty trailing fields would be discarded resulting in the three-element array ["A", "", "B"].
{
"split": {
"field": "my_field",
"separator": ",",
"preserve_trailing": true
}
}
© 2023-2025 Elasticsearch
As of September 2024, Elasticsearch is available under a choice of three licenses: the Server Side Public License (SSPL), the Elastic License, or the AGPLv3 (OSI approved).
Elasticsearch and the Elasticsearch logo are trademarks of Elasticsearch B.V., registered in the U.S. and in other countries.
https://www.elastic.co/guide/en/elasticsearch/reference/7.17/split-processor.html