# Converting to integer nested fields with ruby plugin

**URL:** https://discuss.elastic.co/t/converting-to-integer-nested-fields-with-ruby-plugin/168835
**Category:** Logstash
**Created:** [February 18, 2019, 1:27pm UTC](https://discuss.elastic.co/t/converting-to-integer-nested-fields-with-ruby-plugin/168835 "2019-02-18T13:27:07Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![pastechecker](https://avatars.discourse-cdn.com/v4/letter/p/0ea827/32.png) [@pastechecker](https://discuss.elastic.co/u/pastechecker)
#### Post date: [February 18, 2019, 1:27pm UTC](https://discuss.elastic.co/t/converting-to-integer-nested-fields-with-ruby-plugin/168835/1 "2019-02-18T13:27:07Z")

</div>

Hello.  
I am attempting to convert to field type integer certain fields in my json.

> {  
> "user\_email": "example@com",  
> "user\_id": "8ca5c5b4119b5d9c1b95d9e2af7e4702",  
> "path": "/tmp/mystuff.json",  
> "type": "json",  
> "statistics": {  
> **"deleted\_emails\_number": "0",**  
> **"emails\_number": "0",**  
> "[example.com](http://example.com)": {  
> "template1": {  
> **"deleted\_emails\_number": "0",**  
> **"email\_sent\_count\_number": "0"**  
> },  
> "template2": {  
> **"deleted\_emails\_number": "0",**  
> **"email\_sent\_count\_number": "0"**  
> }  
> },  
> "[example2.com](http://example2.com)": {  
> "template1": {  
> **"deleted\_emails\_number": "0",**  
> **"email\_sent\_count\_number": "0"**  
> },  
> "template2": {  
> **"deleted\_emails\_number": "0",**  
> **"email\_sent\_count\_number": "0"**  
> }  
> },  
> "[exampleN.com](http://exampleN.com)": {  
> "templateN": {  
> **"deleted\_emails\_number": "0",**  
> **"email\_sent\_count\_number": "0"**  
> }  
> }  
> }  
> }  
> }

I might have N templates and N domains, therefore I cannot hardcode it as I have tried before:  
If I do not touch the nested fields I can do that with:

> mutate {  
> convert =\> {  
> "[statistics][deleted\_emails\_number]" =\> "integer"  
> "[statistics][emails\_number]" =\> "integer"  
> }  
> }

I might attempt to access nested fields like:

> mutate {  
> convert =\> {  
> "[statistics][deleted\_emails\_number]" =\> "integer"  
> "[statistics][emails\_number]" =\> "integer"  
> "[statistics][2][0][deleted\_emails\_number]" =\> "integer"  
> "[statistics][2][0][emails\_number]" =\> "integer"  
> "[statistics][2][1][deleted\_emails\_number]" =\> "integer"  
> "[statistics][2][1][emails\_number]" =\> "integer"  
> "[statistics][3][0][deleted\_emails\_number]" =\> "integer"  
> "[statistics][3][0][emails\_number]" =\> "integer"  
> "[statistics][3][1][deleted\_emails\_number]" =\> "integer"  
> "[statistics][3][1][emails\_number]" =\> "integer"  
> }  
> }  
> but that did not work as I expected.

How could I do it using ruby filter, but with nested fields?

> ruby {  
> code =\> "  
> event.set('[statistics][deleted\_emails\_number]', event.get('[statistics][deleted\_emails\_number]').to\_i)  
> "  
> }

Thank you for suggestions.

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [February 18, 2019, 2:17pm UTC](https://discuss.elastic.co/t/converting-to-integer-nested-fields-with-ruby-plugin/168835/2 "2019-02-18T14:17:32Z")

</div>

> [@pastechecker](#):
>
> "[statistics][2][0][deleted\_emails\_number]" =\> "integer"

That's not going to work because none of the fields are arrays. You could do

```
mutate { convert => { "[statistics][example.com][exampleN.com][templateN][email_sent_count_number]" => "integer" } }

```

If you want to iterate over every field then you could do this

```
    ruby {
        code => '
            event.to_hash.each { |k1, v1|
                if k1 == "deleted_emails_number" or k1 == "email_sent_count_number"
                    event.set(k1, v1.to_i)
                elsif v1.is_a? Hash
                    v1.each { |k2, v2|
                        if k2 == "deleted_emails_number" or k2 == "email_sent_count_number"
                            event.set("[#{k1}][#{k2}]", v2.to_i)
                        elsif v2.is_a? Hash
                            v2.each { |k3, v3|
                                if k3 == "deleted_emails_number" or k3 == "email_sent_count_number"
                                    event.set("[#{k1}][#{k2}][#{k3}]", v3.to_i)
                                elsif v3.is_a? Hash
                                    v3.each { |k4, v4|
                                        if k4 == "deleted_emails_number" or k4 == "email_sent_count_number"
                                            event.set("[#{k1}][#{k2}][#{k3}][#{k4}]", v4.to_i)
                                        elsif v4.is_a? Hash
                                            v4.each { |k5, v5|
                                                if k5 == "deleted_emails_number" or k5 == "email_sent_count_number"
                                                    event.set("[#{k1}][#{k2}][#{k3}][#{k4}][#{k5}]", v5.to_i)
                                                end
                                            }
                                        end
                                    }
                                end
                            }
                        end
                    }
                end
            }
        '
    }

```

Obviously that needs to be refactored into something [much cleaner](https://xkcd.com/1270/).

---

<div class="post-metadata">

### Author: ![pastechecker](https://avatars.discourse-cdn.com/v4/letter/p/0ea827/32.png) [@pastechecker](https://discuss.elastic.co/u/pastechecker)
#### Post date: [February 18, 2019, 2:38pm UTC](https://discuss.elastic.co/t/converting-to-integer-nested-fields-with-ruby-plugin/168835/3 "2019-02-18T14:38:34Z")

</div>

Badger, that is very cryptic! 🙂  
I have to apology, I have made a mistake when doing my json above.  
The manual mutate would look like:

```auto
mutate { 
convert => { "[statistics][example.com][template1][email_sent_count_number]" => "integer" } 
convert => { "[statistics][example.com][template1][deleted_emails_number]" => "integer" } 
convert => { "[statistics][example.com][template2][email_sent_count_number]" => "integer" } 
convert => { "[statistics][example.com][template2][deleted_emails_number]" => "integer" } 
convert => { "[statistics][example2.com][template1][email_sent_count_number]" => "integer" } 
convert => { "[statistics][example2.com][template1][deleted_emails_number]" => "integer" } 
convert => { "[statistics][example2.com][template2][email_sent_count_number]" => "integer" } 
convert => { "[statistics][example2.com][template2][deleted_emails_number]" => "integer" } 
}

```

Simplified nests below:

> {  
> "statistics": {  
> "[example.com](http://example.com)": {  
> "template1": {  
> "deleted\_emails\_number": "0",  
> "email\_sent\_count\_number": "0"  
> },  
> "template2": {  
> "deleted\_emails\_number": "0",  
> "email\_sent\_count\_number": "0"  
> }  
> },  
> "[example2.com](http://example2.com)": {  
> "template1": {  
> "deleted\_emails\_number": "0",  
> "email\_sent\_count\_number": "0"  
> },  
> "template2": {  
> "deleted\_emails\_number": "0",  
> "email\_sent\_count\_number": "0"  
> }  
> },  
> "[exampleN.com](http://exampleN.com)": {  
> "templateN": {  
> "deleted\_emails\_number": "0",  
> "email\_sent\_count\_number": "0"  
> }  
> }  
> }  
> }

Do I have to rewrite a great portion of your solution to adapt to this?

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [February 18, 2019, 2:45pm UTC](https://discuss.elastic.co/t/converting-to-integer-nested-fields-with-ruby-plugin/168835/4 "2019-02-18T14:45:37Z")

</div>

The script above would work for that JSON too, but it could be simplified...

```
    ruby {
        code => '
            event.to_hash.each { |k1, v1|
                if v1.is_a? Hash
                    v1.each { |k2, v2|
                        if v2.is_a? Hash
                            v2.each { |k3, v3|
                                if v3.is_a? Hash
                                    v3.each { |k4, v4|
                                        if k4 == "deleted_emails_number" or k4 == "email_sent_count_number"
                                            event.set("[#{k1}][#{k2}][#{k3}][#{k4}]", v4.to_i)
                                        end
                                    }
                                end
                            }
                        end
                    }
                end
            }
        '
    }
```

---

<div class="post-metadata">

### Author: ![pastechecker](https://avatars.discourse-cdn.com/v4/letter/p/0ea827/32.png) [@pastechecker](https://discuss.elastic.co/u/pastechecker)
#### Post date: [February 18, 2019, 3:20pm UTC](https://discuss.elastic.co/t/converting-to-integer-nested-fields-with-ruby-plugin/168835/5 "2019-02-18T15:20:39Z")

</div>

> [@Badger](#):
>
> ruby { code =\> ' event.to\_hash.each { |k1, v1| if v1.is\_a? Hash v1.each { |k2, v2| if v2.is\_a? Hash v2.each { |k3, v3| if v3.is\_a? Hash v3.each { |k4, v4| if k4 == "deleted\_emails\_number" or k4 == "email\_sent\_count\_number" event.set("[#{k1}][#{k2}][#{k3}][#{k4}]", v4.to\_i) end } end } end } end } ' }

Thank you Badger for this contribution, I hope that the community will benefit from this answer.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 18, 2019, 3:20pm UTC](https://discuss.elastic.co/t/converting-to-integer-nested-fields-with-ruby-plugin/168835/6 "2019-03-18T15:20:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
