# Create field depending on array index value

**URL:** <https://discuss.elastic.co/t/create-field-depending-on-array-index-value/124099>\
**Category:** Logstash\
**Created:** [March 15, 2018, 12:41pm UTC](https://discuss.elastic.co/t/create-field-depending-on-array-index-value/124099 "2018-03-15T12:41:01Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![No\_Executable](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/no_executable/32/29075_2.png) [@No\_Executable](https://discuss.elastic.co/u/No_Executable)\
**Post date:** [March 15, 2018, 12:41pm UTC](https://discuss.elastic.co/t/create-field-depending-on-array-index-value/124099/1 "2018-03-15T12:41:01Z")

</div>

What I want to do is depending on the ID, array index 0, is to instead put the ID label, array index 1 into the new field **Command**.

My current filter config looks like this:

```
filter {
    xml {
        source => 'message'
        target => 'doc'
    }
    mutate {
        remove_field => 'message'
        split => {"[doc][Message]" => "	"}
    }
    if "%{[doc][Message][0]}" == "3D3D3D3D3D" {
        mutate {
            add_field => ["Command", "%{[doc][Message][1]}" ]
        }
    }
    else {
        mutate {
            add_field => ["Command", "%{[doc][Message][0]}" ]
        }
    }
}

```

If index 0 is **3D3D3D3D3D** I want to instead pull up the command label which is at index 1.

As it is now it just continues with the **else** and puts **3D3D3D3D3D** in the **Command** field.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [March 15, 2018, 1:05pm UTC](https://discuss.elastic.co/t/create-field-depending-on-array-index-value/124099/2 "2018-03-15T13:05:55Z")

</div>

> [@No\_Executable](#):
>
> if "%{[doc][Message][0]}" == "3D3D3D3D3D" {

That should be

```auto
if [doc][Message][0] == "3D3D3D3D3D" {

```

---

<div class="post-metadata">

**Author:** ![No\_Executable](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/no_executable/32/29075_2.png) [@No\_Executable](https://discuss.elastic.co/u/No_Executable)\
**Post date:** [March 15, 2018, 1:23pm UTC](https://discuss.elastic.co/t/create-field-depending-on-array-index-value/124099/3 "2018-03-15T13:23:13Z")

</div>

So close, yet so far.

Thanks!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 12, 2018, 1:23pm UTC](https://discuss.elastic.co/t/create-field-depending-on-array-index-value/124099/4 "2018-04-12T13:23:36Z")

</div>

Closed on April 12, 2018, 1:23pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.