# Can we use clone filter within ruby code block?

**URL:** https://discuss.elastic.co/t/can-we-use-clone-filter-within-ruby-code-block/2411
**Category:** Logstash
**Created:** [June 11, 2015, 6:50am UTC](https://discuss.elastic.co/t/can-we-use-clone-filter-within-ruby-code-block/2411 "2015-06-11T06:50:50Z")
**Posts on this page:** 10
**Page:** 1

<div class="post-metadata">

### Author: ![Saket\_Kumar](https://avatars.discourse-cdn.com/v4/letter/s/c57346/32.png) [@Saket\_Kumar](https://discuss.elastic.co/u/Saket_Kumar)
#### Post date: [June 11, 2015, 6:50am UTC](https://discuss.elastic.co/t/can-we-use-clone-filter-within-ruby-code-block/2411/1 "2015-06-11T06:50:50Z")

</div>

can we use clone filter within ruby code block?

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [June 11, 2015, 6:55am UTC](https://discuss.elastic.co/t/can-we-use-clone-filter-within-ruby-code-block/2411/2 "2015-06-11T06:55:40Z")

</div>

I don't think you can call filters from within other filters. If you explain what you're trying to accomplish maybe someone can suggest something that you _can_ do.

---

<div class="post-metadata">

### Author: ![Saket\_Kumar](https://avatars.discourse-cdn.com/v4/letter/s/c57346/32.png) [@Saket\_Kumar](https://discuss.elastic.co/u/Saket_Kumar)
#### Post date: [June 11, 2015, 7:05am UTC](https://discuss.elastic.co/t/can-we-use-clone-filter-within-ruby-code-block/2411/3 "2015-06-11T07:05:47Z")

</div>

I parsed xml  
input {  
file {  
path =\> "/opt/Log/new80.xml"  
start\_position =\> "beginning"   
}  
}

filter {  
if [message] =~ "^\<?xml .\*" {  
drop {}  
}  
multiline {  
pattern =\> "^\</response\>"  
negate =\> true  
what =\> "next"  
}

xml {  
source =\> "message"  
target =\> "videoFrames"

```
xpath => [
#"response/data/latency","latency",

"/response/data/run/firstView/videoFrames/frame[*]/time/text()","Time_FV",
   	"/response/data/run/firstView/videoFrames/frame[*]/image/text()","Image_FV",
"/response/data/run/firstView/videoFrames/frame[*]/VisuallyComplete/text()","Progess_FV",

```

Getting output for "Time\_FV": [0,800,1600,1800,2100,2400,3000,3300,3500,3600,3700]

I want to split this array into multiple event and output to elasticsearch. Hence thought of cloning for each item in array.

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [June 11, 2015, 7:19am UTC](https://discuss.elastic.co/t/can-we-use-clone-filter-within-ruby-code-block/2411/4 "2015-06-11T07:19:41Z")

</div>

If the [split filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-split.html) isn't usable for this I think it should be. Worst case, could you use a ruby filter to turn the Time\_FV field into a string that you then feed to the split filter?

---

<div class="post-metadata">

### Author: ![Saket\_Kumar](https://avatars.discourse-cdn.com/v4/letter/s/c57346/32.png) [@Saket\_Kumar](https://discuss.elastic.co/u/Saket_Kumar)
#### Post date: [June 11, 2015, 8:14am UTC](https://discuss.elastic.co/t/can-we-use-clone-filter-within-ruby-code-block/2411/5 "2015-06-11T08:14:37Z")

</div>

do i need to clone event?  
How split works?  
i will try as suggested above.

---

<div class="post-metadata">

### Author: ![Saket\_Kumar](https://avatars.discourse-cdn.com/v4/letter/s/c57346/32.png) [@Saket\_Kumar](https://discuss.elastic.co/u/Saket_Kumar)
#### Post date: [June 11, 2015, 8:26am UTC](https://discuss.elastic.co/t/can-we-use-clone-filter-within-ruby-code-block/2411/6 "2015-06-11T08:26:54Z")

</div>

If i use  
split { field =\> "Time\_FV" }  
what output expected.

---

<div class="post-metadata">

### Author: ![Saket\_Kumar](https://avatars.discourse-cdn.com/v4/letter/s/c57346/32.png) [@Saket\_Kumar](https://discuss.elastic.co/u/Saket_Kumar)
#### Post date: [June 11, 2015, 8:31am UTC](https://discuss.elastic.co/t/can-we-use-clone-filter-within-ruby-code-block/2411/7 "2015-06-11T08:31:05Z")

</div>

this worked great help.

Can I apply split { on multiple fields}?

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [June 11, 2015, 10:22am UTC](https://discuss.elastic.co/t/can-we-use-clone-filter-within-ruby-code-block/2411/8 "2015-06-11T10:22:24Z")

</div>

> Can I apply split { on multiple fields}?

With multiple split filters, sure.

---

<div class="post-metadata">

### Author: ![Saket\_Kumar](https://avatars.discourse-cdn.com/v4/letter/s/c57346/32.png) [@Saket\_Kumar](https://discuss.elastic.co/u/Saket_Kumar)
#### Post date: [June 11, 2015, 10:23am UTC](https://discuss.elastic.co/t/can-we-use-clone-filter-within-ruby-code-block/2411/9 "2015-06-11T10:23:36Z")

</div>

tried but didn't get success.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:37am UTC](https://discuss.elastic.co/t/can-we-use-clone-filter-within-ruby-code-block/2411/10 "2017-07-06T05:37:44Z")

</div>


