# Convert Array to String by ingesting three double quotes

**URL:** https://discuss.elastic.co/t/convert-array-to-string-by-ingesting-three-double-quotes/308358
**Category:** Logstash
**Created:** [June 28, 2022, 12:46pm UTC](https://discuss.elastic.co/t/convert-array-to-string-by-ingesting-three-double-quotes/308358 "2022-06-28T12:46:17Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![Elie](https://avatars.discourse-cdn.com/v4/letter/e/6f9a4e/32.png) [@Elie](https://discuss.elastic.co/u/Elie)
#### Post date: [June 28, 2022, 12:46pm UTC](https://discuss.elastic.co/t/convert-array-to-string-by-ingesting-three-double-quotes/308358/1 "2022-06-28T12:46:17Z")

</div>

Hi,

I am wanting to change an Array to a String to make it easier for me to store in my Elasticsearch, but I am having trouble finding the way of doing so. There are some special cases in my data where my field "value" will have an Array instead of a String, but I seem to not be able to add the three double quotes infront and behind my square brackets where I need them.

The following shows how my data looks like:

```auto
  {
    "Data": [{
            "key": "keyName",
            "value": "valueName"
        },
        {
            "key": "keyName",
            "value": "valueName"
        },
        {
            "key": "keyName",
            "value": [{
                "type": "FailedName",
                "message": "FailedMessage",
                "path": "FailedPath"
            }]
        }
    ]
  }

```

and here is how I want it to be inserted in ES:

```auto
  {
    "Data": [{
            "key": "keyName",
            "value": "valueName"
        },
        {
            "key": "keyName",
            "value": "valueName"
        },
        {
            "key": "keyName",
            "value": """[{
                "type": "FailedName",
                "message": "FailedMessage",
                "path": "FailedPath"
            }]"""
        }
    ]
  }

```

I have tried the mutate-\>gsub method but to no success.

Here is what my config file looks like

```auto
input {
	file{
		start_position => "beginning"
		path => "XXX.json"		
		sincedb_path => "/dev/null"
		codec => multiline {
			pattern => "^Spalanzani" 
			negate => true 
			what => previous 
			auto_flush_interval => 1 
			multiline_tag => "" 
		}
	}
	stdin{}
}

filter {
	mutate {
        gsub => ["[data][customData][value]", "\[", '"""[', "[data][customData][value]", "\]", ']"""' ]
	}
	
	json {
	    source => "message"
	}
}

output {
	stdout {codec => rubydebug}
	elasticsearch {
		hosts => "hostAddress"
		user => "user"
		password => "password"
		index => "index" 
	}
}

```

Could anyone help me figure out how I could make it possible for me to insert three double quotes in front of my array to insert it as a string to ES?

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 28, 2022, 4:33pm UTC](https://discuss.elastic.co/t/convert-array-to-string-by-ingesting-three-double-quotes/308358/2 "2022-06-28T16:33:00Z")

</div>

To change the value from an array to a string you could use mutate+join

```
mutate {
    join => {
        "[Data][0][value]" => ","
        "[Data][1][value]" => ","
        "[Data][2][value]" => ","
        "[Data][3][value]" => ","
    }
}

```

or you could use a ruby filter. I have not tested it, but something like

```
ruby {
    code => '
        d = event.get("Data")
        if d.is_a? Array
            d.each_index { |x|
                if d[x]["value"].is_a? Array
                    d[x]["value"] = d[x]["value"].join(",")
                end
            }
            event.set("Data", d)
        end
    '
}

```

---

<div class="post-metadata">

### Author: ![Elie](https://avatars.discourse-cdn.com/v4/letter/e/6f9a4e/32.png) [@Elie](https://discuss.elastic.co/u/Elie)
#### Post date: [June 29, 2022, 10:40am UTC](https://discuss.elastic.co/t/convert-array-to-string-by-ingesting-three-double-quotes/308358/3 "2022-06-29T10:40:31Z")

</div>

Both of your solutions provided worked perfectly! Thank you Badger.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 27, 2022, 10:40am UTC](https://discuss.elastic.co/t/convert-array-to-string-by-ingesting-three-double-quotes/308358/4 "2022-07-27T10:40:49Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
