Splits a string using a regular expression into an array of values.

ParameterTypeRequiredDefaultDescription
asstringoptional[a]_splitstring Emit selected attribute using this name.
bystringrequired  String or regular expression to split by.
field[b]stringoptional[a]@rawstring Field that needs splitting.
indexnumberoptional[a]  Emit only this index after splitting. Can be negative; -1 designates the last element.

[a] Optional parameters use their default value unless explicitly set

[b] The argument name field can be omitted.

Omitted Argument Names

The argument name for field can be omitted; the following forms of this function are equivalent:

logscale
splitString("@rawstring")

and:

logscale
splitString(field="@rawstring")

splitString() Examples

Assuming an event has the @rawstring="2007-01-01 test bar" you can split the string into fields part[0], part[1], and part[2]:

logscale
...
| part := splitString(field=@rawstring, by=" ")

Assuming an event has the @rawstring:

accesslog
2007-01-01 test bar

You can split pick out the date part using:

logscale
...
| date := splitString(field=@rawstring, by=" ", index=0)

Assuming an event has the @rawstring

<2007-01-01>test;bar

You can split the string into attributes part[0], part[1], and part[2]. In this case, the splitting string is a regex specifying any one of the characters <, >, or ;

logscale
...
| part := splitString(field=@rawstring, by="[<>;]")

Split an event into multiple events by newlines. The first function splitString() creates @rawstring[0], @rawstring[1], ... for each line, and the following split() creates the multiple events from the array of rawstrings.

logscale
...
| splitString(by="\n", as=@rawstring)
| split(@rawstring)

Split the value of a string field into individual characters:

logscale
characters := splitstring(my_field, by="(?!\A)(?=.)")

Split the value of a string using case-insensitive regex:

logscale
characters := splitstring(my_field, by="(?i)(e
| encoded
| enc)")

Split the string using a multi-character separator. This can be used for system logs that use the multi-character separator to allow a character such as comma or colon that might otherwise be used as a separator. Because the value to the by is a regular expression, you should use a regular expression group as the value. For example:

logscale
splitString(by="(\*\|\*)")

Splits incoming data by the string *|* and would correctly split the string image.png*|*PNG*|*0755*|*john into:

Field,Value
_splitstring[0],image.png
_splitstring[1],PNG
_splitstring[2],0755
_splitstring[3],john

Note

Special characters (including asterisk and pipe) also need to be escaped.