Split processor

The Split processor splits a field value into an array using a separator.

To split a field into an array:

Select Create → Create processor.
Select Split from the Processor menu.
Set the Source Field to the field you want to split into an array.
Set Separator to a regex that matches the separator. For example, use , for commas, \s+ for whitespace, or \. for a literal dot.
(Optional) Set Target field to write the resulting array to a different field. Leave empty to update the Source Field.

This functionality uses the Elasticsearch Split processor internally, but you configure it in Streamlang. Streamlang doesn't always have 1:1 parity with the ingest processor options and behavior. Refer to Processor limitations and inconsistencies.

YAML reference

In YAML mode, configure the split processor using the following parameters. For the complete Streamlang syntax, refer to the Streamlang reference.

Parameter	Type	Required	Description
`from`	string	Yes	Source field to split into an array.
`separator`	string	Yes	Regex separator used to split the field value into an array.
`to`	string	No	Target field for the split array. Defaults to the source field.
`preserve_trailing`	boolean	No	When `true`, preserve empty trailing fields in the split result.
`ignore_missing`	boolean	No	When `true`, skip this processor if the source field is missing.

- action: split
  from: attributes.tags
  separator: ","

Given a document with attributes.tags set to foo,bar,baz, the processor updates the field to ["foo", "bar", "baz"].