# Copy complete event to a field of a new event
**URL:** https://discuss.elastic.co/t/copy-complete-event-to-a-field-of-a-new-event/295583
**Category:** Logstash
**Created:** [January 27, 2022, 1:08pm UTC](https://discuss.elastic.co/t/copy-complete-event-to-a-field-of-a-new-event/295583 "2022-01-27T13:08:08Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@HansPeterSloot](https://discuss.elastic.co/u/HansPeterSloot)
#### Post date: [January 27, 2022, 1:08pm UTC](https://discuss.elastic.co/t/copy-complete-event-to-a-field-of-a-new-event/295583/1 "2022-01-27T13:08:08Z")
Hi,
I want to copy all fields of an event to a field of a new event in a logstash filter
This
```auto
{
" agent ": " Mozilla / 5.0(compatible; MSIE 9.0)",
" ip ": " 192.168.24.44 ",
" request ": " / index.html "
" response ": {
" status ": 200,
" bytes ": 52353
},
" ua ": {
" os ": " Windows 7 "
}
}
```
should become
```auto
{
"original_event" : {
" agent ": " Mozilla / 5.0(compatible; MSIE 9.0)",
" ip ": " 192.168.24.44 ",
" request ": " / index.html "
" response ": {
" status ": 200,
" bytes ": 52353
},
" ua ": {
" os ": " Windows 7 "
}
}
}
```
Any smart hints?
---
### Author:  [@Tomo\_M](https://discuss.elastic.co/u/Tomo_M)
#### Post date: [January 27, 2022, 2:29pm UTC](https://discuss.elastic.co/t/copy-complete-event-to-a-field-of-a-new-event/295583/2 "2022-01-27T14:29:31Z")
This is not smart but works.
```auto
filter {
ruby {
code => "
event.to_hash.each{|k,v|
if (!k.start_with?('@'))
event.set('[original_message]['+k+']', v)
event.remove(k)
end
}"
}
}
```
And if (possibly only if) you are using Elasticsearch input plugin, there are [target parameter](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-elasticsearch.html#plugins-inputs-elasticsearch-target) for that purpose.
---
### Author:  [@HansPeterSloot](https://discuss.elastic.co/u/HansPeterSloot)
#### Post date: [January 27, 2022, 2:44pm UTC](https://discuss.elastic.co/t/copy-complete-event-to-a-field-of-a-new-event/295583/3 "2022-01-27T14:44:27Z")
I was thinking about
```auto
new_event = LogStash::Event.new
event.to_hash.each{|k,v|
if (!k.start_with?('@'))
new_event.set('[original_message]['+k+']', v)
end
return [new_event]
}"
```
But I am not 100% sure that the return is correct.
Anyone knows?
Regards Hans
---
### Author:  [@HansPeterSloot](https://discuss.elastic.co/u/HansPeterSloot)
#### Post date: [January 28, 2022, 2:24pm UTC](https://discuss.elastic.co/t/copy-complete-event-to-a-field-of-a-new-event/295583/4 "2022-01-28T14:24:08Z")
I have no idea what is going wrong
If I implement this:
```auto
ruby {
code => '
# Move everything to data
event.set("data", event.to_hash)
# Remove fields other than data
fields = event.to_hash.keys
fields.each{|field|
if (field != "data")
event.remove(field)
end
}
'
}
```
The entire event is empty.
As if a event.cancel has been performed
Any clues? Heeeellp š„“
---
### Author:  [@Tomo\_M](https://discuss.elastic.co/u/Tomo_M)
#### Post date: [January 28, 2022, 3:34pm UTC](https://discuss.elastic.co/t/copy-complete-event-to-a-field-of-a-new-event/295583/5 "2022-01-28T15:34:05Z")
Your script looks working fine in my environment (Windows, Logstash 7.16.3).. What causes the difference??
```auto
input {
stdin{}
}
filter {
ruby {
code => '
# Move everything to data
event.set("data", event.to_hash)
# Remove fields other than data
fields = event.to_hash.keys
fields.each{|field|
if (field != "data")
event.remove(field)
end
}
'
}
}
output {
stdout{
codec=>rubydebug{ metadata => true }
}
}
```
```auto
>>test
{
"data" => {
"@timestamp" => 2022-01-28T15:30:16.269Z,
"host" => "",
"@version" => "1",
"message" => "test\r"
}
}
```
---
### Author:  [@HansPeterSloot](https://discuss.elastic.co/u/HansPeterSloot)
#### Post date: [January 28, 2022, 4:04pm UTC](https://discuss.elastic.co/t/copy-complete-event-to-a-field-of-a-new-event/295583/6 "2022-01-28T16:04:19Z")
I have no idea.
But I found this:
> [@Ruby Filter - Event.Remove Inconsistent Results](https://discuss.elastic.co/t/ruby-filter-event-remove-inconsistent-results/138268):
>
> Problem Statement I believe there is a bug in the ruby filter plugin when using event.remove Expected Output: ... event\_data.sql\_text =\> "some sql text" event\_data.logType =\> "Oracle" ... With no root fields (e.g., sql\_text or logType). All data should reside under event\_data nested object. Background: I am using docker instances to run an ES stack (3 Elasticsearches, 1 Logstash). I have tested this with docker versions 6.0.0 and 6.3.0 for Logstash. I'm pulling in data from variety of sourceā¦
Looks very much the same.
If have created a script and pointed have the path variable point to it.
In this script I created a new event with
```auto
def filter(event)
docs = []
new_event = LogStash::Event.new
**
docs.push(new_event)
return docs
```
and fill this event with correct format
To no avail
I cannot remove the fields in a hardcoded way because the formats of the events differ.
Regards Hans
---
### Author:  [@HansPeterSloot](https://discuss.elastic.co/u/HansPeterSloot)
#### Post date: [January 28, 2022, 9:27pm UTC](https://discuss.elastic.co/t/copy-complete-event-to-a-field-of-a-new-event/295583/7 "2022-01-28T21:27:48Z")
will try with 7.16 too
---
### Author:  [@HansPeterSloot](https://discuss.elastic.co/u/HansPeterSloot)
#### Post date: [January 31, 2022, 9:26am UTC](https://discuss.elastic.co/t/copy-complete-event-to-a-field-of-a-new-event/295583/8 "2022-01-31T09:26:52Z")
Hello
I found out that as soon as I do :
`event.remove("tags")`
The entire contents of the event are gone.
Regards Hans-Peter
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 28, 2022, 9:27am UTC](https://discuss.elastic.co/t/copy-complete-event-to-a-field-of-a-new-event/295583/9 "2022-02-28T09:27:15Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.