title: how do i split message into 2 properties based on one of 2 tokens?
body: <p>I think this is a simple case, but I have been having issues implementing it.</p>
  
  <p>My input message is in the format:  <code>aaaaaaaaa;bbbbbbbbbb</code> or <code>aaaaaaa:bbbbbbb</code> and what i was trying to do was to split on either of the colon or semicolon, and then assign them to key and value pairs.</p>
  
  <p>I was doing 2 mutates but it was erroring on that when I ran some sample tests.</p>
  
  <pre><code>mutate{
    split =&gt; {
      "message" =&gt; ":"
    }
    add_field =&gt; {
      "key" =&gt; "%{[message][0]}"
      "value" =&gt; "%{[message][1]}"
    }
  }
  mutate{
    split =&gt; {
      "message" =&gt; ";"
    }
    add_field =&gt; {
      "key" =&gt; "%{[message][0]}"
      "value" =&gt; "%{[message][1]}"
    }
  }
  </code></pre>
  
  <p>but i dont think that was right.  I was then looking more into grok but wasnt sure if that was how it works.</p>
  
  <p>Should I instead be doing:</p>
  
  <pre><code>filter {
    grok {
      match =&gt; { "message" =&gt; "%{key}:%{value}" }
    }
    grok {
      match =&gt; { "message" =&gt; "%{key};%{value}" }
    }
  }
  </code></pre>