mutate {
       split => ["message","Employee"]
       add_field => {"part1" =>"%{[message][0]}"}
       add_field => {"part2" =>"%{[message][1]}"}
}


mutate {
       split => ["part2","#"]
       add_field => {"part2_1" =>"%{[part2][0]}"}
       add_field => {"part2_2" =>"%{[part2][1]}"}
}