# Creating object with ruby

**URL:** <https://discuss.elastic.co/t/creating-object-with-ruby/189551>\
**Category:** Logstash\
**Created:** [July 9, 2019, 12:56pm UTC](https://discuss.elastic.co/t/creating-object-with-ruby/189551 "2019-07-09T12:56:56Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Rom1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rom1/32/49699_2.png) [@Rom1](https://discuss.elastic.co/u/Rom1)\
**Post date:** [July 9, 2019, 12:56pm UTC](https://discuss.elastic.co/t/creating-object-with-ruby/189551/1 "2019-07-09T12:56:56Z")

</div>

Hi all,

I have an event with fields containing tables:

> {"pfp":{"cfr":["A", "B", "C"], "name":["X", "Y", "Z"]}}

I would like to transform them into objects:

> "pfp" =\> [  
> [0] {  
> "cfr" =\> "A",  
> "name" =\> "X"  
> },  
> [1] {  
> "cfr" =\> "B",  
> "name" =\> "Y"  
> },  
> [2] {  
> "cfr" =\> "C",  
> "name" =\> "Z"  
> }  
> ]

I tried to do this with ruby unsuccessfully...

My best try was:

> filter {  
> ruby {  
> code =\> '  
> if event.get("[pfp][cfr]").length == event.get("[pfp][name]").length  
> event.get("[pfp][cfr]").each\_index { |i|  
> event.set("[pfp\_tmp]", [Hash["cfr",event.get("[pfp][cfr][#{i}]"),"name",event.get("[pfp][name][#{i}]")]])  
> }  
> end  
> '  
> }  
> }

But the result is (I put the result into a new field 'pfp\_tmp' in order to compare it with the source):

> {  
> "pfp\_tmp" =\> [  
> [0] {  
> "cfr" =\> "C",  
> "name" =\> "Z"  
> }  
> ],  
> "pfp" =\> {  
> "cfr" =\> [  
> [0] "A",  
> [1] "B",  
> [2] "C"  
> ],  
> "name" =\> [  
> [0] "X",  
> [1] "Y",  
> [2] "Z"  
> ]  
> }  
> }  
> As you can see, the pfp\_tmp field is not a table, only the last data is present.

I also tried to set the field with `event.set("[pfp_tmp][#{i}]", ...` but the result was `pfp_tmp => { "0" => {...}, "1"=> {...}` which is not really a table

Any idea?  
Thank you for help.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 9, 2019, 1:49pm UTC](https://discuss.elastic.co/t/creating-object-with-ruby/189551/2 "2019-07-09T13:49:57Z")

</div>

```
    ruby {
        code => '
            if event.get("[pfp][cfr]").length == event.get("[pfp][name]").length
                a = []
                event.get("[pfp][cfr]").each_index { |i|
                    a << Hash["cfr",event.get("[pfp][cfr][#{i}]"),"name",event.get("[pfp][name][#{i}]")]
                }
                event.set("[pfp_tmp]", a)
            end
        '
    }
```

---

<div class="post-metadata">

**Author:** ![Rom1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rom1/32/49699_2.png) [@Rom1](https://discuss.elastic.co/u/Rom1)\
**Post date:** [July 9, 2019, 9:48pm UTC](https://discuss.elastic.co/t/creating-object-with-ruby/189551/3 "2019-07-09T21:48:54Z")

</div>

Thx Badger,  
It works fine !!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 6, 2019, 9:48pm UTC](https://discuss.elastic.co/t/creating-object-with-ruby/189551/4 "2019-08-06T21:48:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.