Split processor
The Split processor splits a field value into an array using a separator.
To split a field into an array:
- Select Create → Create processor.
- Select Split from the Processor menu.
- Set the Source Field to the field you want to split into an array.
- Set Separator to a regex that matches the separator. For example, use
,for commas,\s+for whitespace, or\.for a literal dot. - (Optional) Set Target field to write the resulting array to a different field. Leave empty to update the Source Field.
This functionality uses the Elasticsearch Split processor internally, but you configure it in Streamlang. Streamlang doesn't always have 1:1 parity with the ingest processor options and behavior. Refer to Processor limitations and inconsistencies.
In YAML mode, configure the split processor using the following parameters. For the complete Streamlang syntax, refer to the Streamlang reference.
| Parameter | Type | Required | Description |
|---|---|---|---|
from |
string | Yes | Source field to split into an array. |
separator |
string | Yes | Regex separator used to split the field value into an array. |
to |
string | No | Target field for the split array. Defaults to the source field. |
preserve_trailing |
boolean | No | When true, preserve empty trailing fields in the split result. |
ignore_missing |
boolean | No | When true, skip this processor if the source field is missing. |
- action: split
from: attributes.tags
separator: ","
Given a document with attributes.tags set to foo,bar,baz, the processor updates the field to ["foo", "bar", "baz"].