# Add Nested Field Array Value based on Array String

**URL:** <https://discuss.elastic.co/t/add-nested-field-array-value-based-on-array-string/239286>\
**Category:** Logstash\
**Created:** [June 30, 2020, 11:44am UTC](https://discuss.elastic.co/t/add-nested-field-array-value-based-on-array-string/239286 "2020-06-30T11:44:51Z")\
**Posts on this page:** 17\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kevin\_f](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kevin_f/32/72456_2.png) [@Kevin\_f](https://discuss.elastic.co/u/Kevin_f)\
**Post date:** [June 30, 2020, 11:44am UTC](https://discuss.elastic.co/t/add-nested-field-array-value-based-on-array-string/239286/1 "2020-06-30T11:44:52Z")

</div>

Hello All,

I would like to have some assistance on how to add a nested field array to a new field based on the key string value.

As you can see in the json output below, I am simply trying to add the nested field [properties][additionalDetails][value]] if "key" = "invitedUserEmailAddress"

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/9/8984e959129c860f457c22aa6c000c0cd62d2339.png)

I have tried:

```auto
filter {
 if "invitedUserEmailAddress" in [properties][additionalDetails] {
    mutate {
      add_field => { "EmailAddress" => "%{[properties][additionalDetails][][value]}" }
   }
 }
}

```

Which I am hoping to see the output on kibana as a new field added:

```auto
EmailAddress AanhaneA@net

```

But can't figure out how to add that paticular value for when only if "key" = "InviteUserEmailAddress"

Any help would be much appreciated. Thanks.

---

<div class="post-metadata">

**Author:** ![Jenni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jenni/32/29684_2.png) [@Jenni](https://discuss.elastic.co/u/Jenni)\
**Post date:** [June 30, 2020, 12:29pm UTC](https://discuss.elastic.co/t/add-nested-field-array-value-based-on-array-string/239286/2 "2020-06-30T12:29:24Z")

</div>

I think you'll have to use Ruby: Iterate over `[properties][additionalDetails]` and if the string in `key` is the one you are looking for, fill the field `EmailAddress` with `value`.  
It's similar to this: [Ruby code for array iteration](https://discuss.elastic.co/t/ruby-code-for-array-iteration/137450/2)

---

<div class="post-metadata">

**Author:** ![Kevin\_f](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kevin_f/32/72456_2.png) [@Kevin\_f](https://discuss.elastic.co/u/Kevin_f)\
**Post date:** [June 30, 2020, 12:41pm UTC](https://discuss.elastic.co/t/add-nested-field-array-value-based-on-array-string/239286/3 "2020-06-30T12:41:13Z")

</div>

Thank you Jenni,

However I am not familiar with ruby code. Not sure how that fits into what I am trying to do.

Something like this?

```auto
filter {
 mutate {
      add_field => { "EmailAddress" => "def" }
  }

ruby {
        code => '
            event.get('[properties][additionalDetails]').each do |item|
  				if item['key'] == 'invitedUserEmailAddress'
    				event.set('EmailAddress', '[properties][additionalDetails][value]')
  				end
			end
            '
        }
}

```

---

<div class="post-metadata">

**Author:** ![Jenni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jenni/32/29684_2.png) [@Jenni](https://discuss.elastic.co/u/Jenni)\
**Post date:** [June 30, 2020, 1:15pm UTC](https://discuss.elastic.co/t/add-nested-field-array-value-based-on-array-string/239286/4 "2020-06-30T13:15:13Z")

</div>

That looks nearly right. Use` item['value]` to access the value within your loop. And wrap your code in double quotes if you use single quotes in the code.

---

<div class="post-metadata">

**Author:** ![Kevin\_f](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kevin_f/32/72456_2.png) [@Kevin\_f](https://discuss.elastic.co/u/Kevin_f)\
**Post date:** [June 30, 2020, 1:23pm UTC](https://discuss.elastic.co/t/add-nested-field-array-value-based-on-array-string/239286/5 "2020-06-30T13:23:21Z")

</div>

Thanks Jenni,

So like:

```auto
filter {
 mutate {
      add_field => { "EmailAddress" => "def" }
  }

ruby {
        code => "
            event.get("[properties][additionalDetails]").each do |item|
  				if item["key"] == "invitedUserEmailAddress"
    				event.set("EmailAddress", "[properties][additionalDetails][value]")
  				end
			end
            "
        }
}

```

Isn't item["key"] right?

As shown in the json output in the question, I want to check if the array "key" == "invitedUserEmailAddress"

And if that is true, then add its associated value i.e "value" : "AanhaneA@net" to a new field called EmailAddress

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 30, 2020, 4:16pm UTC](https://discuss.elastic.co/t/add-nested-field-array-value-based-on-array-string/239286/6 "2020-06-30T16:16:52Z")

</div>

> [@Kevin\_f](#):
>
> ```auto
> if item["key"] == "invitedUserEmailAddress"
> event.set("EmailAddress", "[properties][additionalDetails][value]")
> end
> 
> ```

That should be

```
if item["key"] == "invitedUserEmailAddress"
		event.set("EmailAddress", item["value"])
end

```

---

<div class="post-metadata">

**Author:** ![Jenni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jenni/32/29684_2.png) [@Jenni](https://discuss.elastic.co/u/Jenni)\
**Post date:** [June 30, 2020, 4:17pm UTC](https://discuss.elastic.co/t/add-nested-field-array-value-based-on-array-string/239286/7 "2020-06-30T16:17:10Z")

</div>

1. I was talking about the **value**. You used the correct code to use the `key` in Ruby. But when you needed the `value`, you just wrote `'[properties][additionalDetails][value]'` which would literally just insert the string '[properties][additionalDetails][value]' into the field `EmailAddress`.
2. If you change the quotes at both places, it won't help at all. The point is that the programming language needs to know which quotes belong to each other. If you write `'` to say "This is where my ruby code begins" and then use `'` again to say "This is where a string in my ruby code begins", it won't work. What the computer sees is `event.get(` (the text between the first `'...'`) as the code that you want to execute and a lot of nonsense after that, that doesn't belong there. Then it will cry "syntax error!" and do nothing.

* * *

```
ruby {
  code => "
    event.get('[properties][additionalDetails]').each do |item|
      if item['key'] == 'invitedUserEmailAddress'
        event.set('EmailAddress', item['value'])
      end
   end
 "
}
```

---

<div class="post-metadata">

**Author:** ![Kevin\_f](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kevin_f/32/72456_2.png) [@Kevin\_f](https://discuss.elastic.co/u/Kevin_f)\
**Post date:** [June 30, 2020, 5:03pm UTC](https://discuss.elastic.co/t/add-nested-field-array-value-based-on-array-string/239286/8 "2020-06-30T17:03:42Z")

</div>

Ahh I see. Sorry I was confused.

Thank you both for this. I shall go away and do these tests. Will come back if I face any issues.  
Much appreciated! 🙂

---

<div class="post-metadata">

**Author:** ![Kevin\_f](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kevin_f/32/72456_2.png) [@Kevin\_f](https://discuss.elastic.co/u/Kevin_f)\
**Post date:** [June 30, 2020, 5:12pm UTC](https://discuss.elastic.co/t/add-nested-field-array-value-based-on-array-string/239286/9 "2020-06-30T17:12:56Z")

</div>

Hi,

Seems like this ruby code is invalid according to logstash pipeline.

```auto
[FATAL] 2020-06-30 17:11:04.597 [LogStash::Runner] runner - The given configuration is invalid. Reason: Expected one of [\t\r\n], "#", "{", "}" at line 23, column 25 (byte 519) after filter {

```

The full config file are as follows:

```auto
input {
    azureblob {
        storage_account_name => " ********"
        storage_access_key => " ********"
        container => " *******"
        add_field => { "service" => "azure" }
        tags => ['test']
        codec => "json"
        registry_lease_duration => 60
        registry_create_policy => resume
        file_head_bytes => 0
        file_tail_bytes => 0
    }
}

```

```auto
filter {
 if [service] == "azure" {
   mutate {
      add_field => { "EmailAddress" => "def" }
   }
   ruby {
        code => "
             event.get("[properties][additionalDetails]").each do |item|
               if item["key"] == "invitedUserEmailAddress"
                event.set("EmailAddress", item["value"])
               end
             end
        "
   }
 }
}

```

```auto
output {
  if [service] == "azure" {
    elasticsearch {
      hosts => ["https://node1.elastic.test.com:9200"]
      cacert => "/etc/logstash/certs/ca.crt"
      index => "logstash-azure-%{+YYYY.MM}"
      user => " ********"
      password => " *******"
    }
  }
}

```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 30, 2020, 5:27pm UTC](https://discuss.elastic.co/t/add-nested-field-array-value-based-on-array-string/239286/10 "2020-06-30T17:27:01Z")

</div>

> [@Kevin\_f](#):
>
> ```auto
> ruby {
> code => "
> event.get("[properties][additionalDetails]").each do |item|
> if item["key"] == "invitedUserEmailAddress"
> event.set("EmailAddress", item["value"])
> end
> end
> "
> }
> 
> ```

Perhaps you did not understand what Jenni was saying. If your code contains double quotes then surround it in single quotes. Change this to

```
ruby {
    code => '
         event.get("[properties][additionalDetails]").each do |item|
           if item["key"] == "invitedUserEmailAddress"
            event.set("EmailAddress", item["value"])
           end
         end
    '
}

```

---

<div class="post-metadata">

**Author:** ![Kevin\_f](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kevin_f/32/72456_2.png) [@Kevin\_f](https://discuss.elastic.co/u/Kevin_f)\
**Post date:** [June 30, 2020, 5:44pm UTC](https://discuss.elastic.co/t/add-nested-field-array-value-based-on-array-string/239286/12 "2020-06-30T17:44:47Z")

</div>

Thank you Badger that worked seemlessly. You're a star!

---

<div class="post-metadata">

**Author:** ![Kevin\_f](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kevin_f/32/72456_2.png) [@Kevin\_f](https://discuss.elastic.co/u/Kevin_f)\
**Post date:** [July 1, 2020, 8:23am UTC](https://discuss.elastic.co/t/add-nested-field-array-value-based-on-array-string/239286/13 "2020-07-01T08:23:36Z")

</div>

Hi @Badger/@Jenni

With this ruby code, is there a way to not specify the new field "EmailAddress" if the nested field array value "key" does not equal "invitedUserEmailAddress"

It is because I am seeing this in my index too:

![image](https://us1.discourse-cdn.com/elastic/original/3X/b/5/b5a2434c0bab3c56748f53b395751495f2f4263c.png)

Or instead of seeing the value "def" to at least show "-" or null ?

---

<div class="post-metadata">

**Author:** ![Jenni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jenni/32/29684_2.png) [@Jenni](https://discuss.elastic.co/u/Jenni)\
**Post date:** [July 1, 2020, 8:38am UTC](https://discuss.elastic.co/t/add-nested-field-array-value-based-on-array-string/239286/14 "2020-07-01T08:38:21Z")

</div>

You explicitly added the field with that value. I assumed that you did that on purpose. Delete that part of your configuration, if you didn't.

> [@Kevin\_f](#):
>
> ```auto
> mutate {
> add_field => { "EmailAddress" => "def" }
> }
> 
> ```

---

<div class="post-metadata">

**Author:** ![Kevin\_f](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kevin_f/32/72456_2.png) [@Kevin\_f](https://discuss.elastic.co/u/Kevin_f)\
**Post date:** [July 1, 2020, 8:41am UTC](https://discuss.elastic.co/t/add-nested-field-array-value-based-on-array-string/239286/15 "2020-07-01T08:41:02Z")

</div>

Ahhh, sorry I assumed that I had to add a new field first as I did not understand that the ruby code will add that for me

So me removing this "add\_field" should fix this issue?

---

<div class="post-metadata">

**Author:** ![Jenni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jenni/32/29684_2.png) [@Jenni](https://discuss.elastic.co/u/Jenni)\
**Post date:** [July 1, 2020, 8:53am UTC](https://discuss.elastic.co/t/add-nested-field-array-value-based-on-array-string/239286/16 "2020-07-01T08:53:02Z")

</div>

Yes. `event.set()` in Ruby will create the field if it does not exist and update it if it does.

---

<div class="post-metadata">

**Author:** ![Kevin\_f](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kevin_f/32/72456_2.png) [@Kevin\_f](https://discuss.elastic.co/u/Kevin_f)\
**Post date:** [July 1, 2020, 10:02am UTC](https://discuss.elastic.co/t/add-nested-field-array-value-based-on-array-string/239286/17 "2020-07-01T10:02:33Z")

</div>

Awesome thank you! Much appreciated.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 29, 2020, 10:02am UTC](https://discuss.elastic.co/t/add-nested-field-array-value-based-on-array-string/239286/18 "2020-07-29T10:02:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.