# Add filed inside of array

**URL:** <https://discuss.elastic.co/t/add-filed-inside-of-array/61899>\
**Category:** Logstash\
**Created:** [September 30, 2016, 7:28am UTC](https://discuss.elastic.co/t/add-filed-inside-of-array/61899 "2016-09-30T07:28:19Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![dsever](https://avatars.discourse-cdn.com/v4/letter/d/91b2a8/32.png) [@dsever](https://discuss.elastic.co/u/dsever)\
**Post date:** [September 30, 2016, 7:28am UTC](https://discuss.elastic.co/t/add-filed-inside-of-array/61899/1 "2016-09-30T07:28:19Z")

</div>

Hi,

I've run into situation that we need to insert new filed into json array, let say for instance:

json

alert:[  
{attrib1:"something",attrib2:"something"},  
{attrib1:"somethingddd",attrib2:"somethingsss"},  
{attrib1:"somethingddd",attrib2:"somethingdd"}

]

Problem is that I have variable number of json array entries.  
So question is, how to address all array entries ( don't know size in advance), and add field in logstash (mutate or something else)

so after calling add\_field =\> I want that my json looks like:

alert:[  
{newfield:"",attrib1:"something",attrib2:"something"},  
{newfield:"",attrib1:"somethingddd",attrib2:"somethingsss"},  
{newfield:"",attrib1:"somethingddd",attrib2:"somethingdd"}  
]

Also is there anyway to detect that nested json is array, in a case I getting two kinds of json like:

alert:{}  
alert:[{},{},{}]

Thanks in advance  
Dubravko

---

<div class="post-metadata">

**Author:** ![dsever](https://avatars.discourse-cdn.com/v4/letter/d/91b2a8/32.png) [@dsever](https://discuss.elastic.co/u/dsever)\
**Post date:** [September 30, 2016, 12:27pm UTC](https://discuss.elastic.co/t/add-filed-inside-of-array/61899/2 "2016-09-30T12:27:32Z")

</div>

Hi,

Looks like I've resolved my problems by using ruby:

```
 ruby {
            code => "event['keep']=(event['alert']).kind_of?(Array)"
    }

  if !([keep]) {
            drop {}
        }
 ruby{
            code => "i=0
                     size=event['alert'].length
                     while i < size do
                         event['alert'][i]['explanation']['malware-detected']['malware']['collected']= false
                         event['alert'][i]['explanation']['malware-detected']['malware']['analyzed']= false
                         event['alert'][i]['explanation']['malware-detected']['malware']['malware_confirmed']= false
                         event['alert'][i]['explanation']['malware-detected']['malware']['scan_results']= {}
                         i+=1
                     end"
                      }

```

And everything looks ok, even result is ok, I'm still getting exception below, look like bug or something?  
[root@centos-dev bin]# ./logstash -f /root/first\_pipeline.conf  
Settings: Default pipeline workers: 2  
Pipeline main started  
Ruby exception occurred: can't convert String into Integer {:level=\>:error}

Thanks  
Dubravko

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:36am UTC](https://discuss.elastic.co/t/add-filed-inside-of-array/61899/3 "2017-07-06T04:36:17Z")

</div>