# Digging values out of embedded hashes
**URL:** https://discuss.elastic.co/t/digging-values-out-of-embedded-hashes/115191
**Category:** Logstash
**Created:** [January 11, 2018, 11:43pm UTC](https://discuss.elastic.co/t/digging-values-out-of-embedded-hashes/115191 "2018-01-11T23:43:34Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@Jason\_Brooks](https://discuss.elastic.co/u/Jason_Brooks)
#### Post date: [January 11, 2018, 11:43pm UTC](https://discuss.elastic.co/t/digging-values-out-of-embedded-hashes/115191/1 "2018-01-11T23:43:34Z")
Hello,
I have spent all day trying to do this, but I am pretty sure that a) not knowing enough ruby and b) not being familiar enough wth logstash is killing me.
I am running logstash 6.1 on ubuntu 16.04LTS server.
I have the following json data fragment
```
{ "events": [{
"attributes": [{
"name": "messageId",
"value": "30797758",
"type": "number",
"isSync": false
}, {
"name": "reportId",
"value": "1142603714",
"type": "number",
"isSync": false
}]
}]
}
```
I wish to produce something more like this:
```
"attributes" => {
"messageId" => 30797758,
"reportId" => 1142603714
}
```
Note how I transpose for each element of "attributes" that "name" becomes the key and "value" becomes the value of the key "name".
I am trying to do it with a ruby filter using the logstash config:
```
input { codec=>json }
filter{
json { source=>"message"
ruby {
code=>'
things=event.get("[events][0][attributes]")
newhash={}
if things.is_a?(Array)
things.each{ |attr| newhash[attr["name"] => attr["value"]]}
end
event.set("[newhash]", newhash )
'
}
output { codec => rubydebug }
```
the trouble is newhash doesn't show anything:
```
"newhash" => {},
```
instead of the things.each line, I have tried various versions of:
```
things.each{ |attr| event.set{[attributes2][#{attr["name"]}], attr["value"] } }
```
but here I just get an error.
I am not at wits end, but I thought I would give it a go before I wrote here.
Does anyone have any suggestions?
Thanks in advance...
--jason
---
### Author:  [@Jason\_Brooks](https://discuss.elastic.co/u/Jason_Brooks)
#### Post date: [January 12, 2018, 12:19am UTC](https://discuss.elastic.co/t/digging-values-out-of-embedded-hashes/115191/2 "2018-01-12T00:19:52Z")
Wait: I think I got it!
```
things=event.get("[events][0][attributes]")
newhash={}
if things.is_a?(Array)
things.each{ |xx| newhash["#{xx["name"]}"] = xx["value"] }
end
event.set("[newhash]", newhash )
```
please feel free to critique me! š
---
### Author:  [@guyboertje](https://discuss.elastic.co/u/guyboertje)
#### Post date: [January 16, 2018, 6:08pm UTC](https://discuss.elastic.co/t/digging-values-out-of-embedded-hashes/115191/3 "2018-01-16T18:08:17Z")
Marked up the error:
```auto
input { codec=>json }
filter{
json { source=>"message"
ruby {
code=>'
things=event.get("[events][0][attributes]")
newhash={}
if things.is_a?(Array)
# move this bracketā¤µ
things.each{ |attr| newhash[attr["name"] => attr["value"]]}
# to hereā¤“ ā²this > is not needed.
end
event.set("[newhash]", newhash )
'
}
output { codec => rubydebug }
```
should be:
`things.each{ |attr| newhash[attr["name"]] = attr["value"]}`
---
### Author:  [@Jason\_Brooks](https://discuss.elastic.co/u/Jason_Brooks)
#### Post date: [January 16, 2018, 6:38pm UTC](https://discuss.elastic.co/t/digging-values-out-of-embedded-hashes/115191/4 "2018-01-16T18:38:44Z")
Ooh: I will compare this to my solution...
Thank you!
---
### Author:  [@Jason\_Brooks](https://discuss.elastic.co/u/Jason_Brooks)
#### Post date: [January 30, 2018, 12:04am UTC](https://discuss.elastic.co/t/digging-values-out-of-embedded-hashes/115191/5 "2018-01-30T00:04:21Z")
> [@guyboertje](#):
>
> things.each{ |attr| newhash[attr["name"]] = attr["value"]}
Hello @guyboertje,
I just tried your solution, and it works perfectly.
I compared it to mine, which also appears to work.
your line followed by mine:
> things.each{ |attr| newhash[attr["name"]] = attr["value"]}
> things.each{ |attr| newhash["#{attr["name"]}"] = attr["value"] }
Of course, I can't now recall why I used #{attr["name"]}" rather than just attr["name"], and I imagine my code just goes through more gyrations than yours... But I am fairly pleased how close they are!
Thank you for your help! I really appreciate it!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 27, 2018, 12:04am UTC](https://discuss.elastic.co/t/digging-values-out-of-embedded-hashes/115191/6 "2018-02-27T00:04:34Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.