# Dissect json array of strings

**URL:** <https://discuss.elastic.co/t/dissect-json-array-of-strings/239711>\
**Category:** Logstash\
**Created:** [July 2, 2020, 9:15pm UTC](https://discuss.elastic.co/t/dissect-json-array-of-strings/239711 "2020-07-02T21:15:51Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![theflakes](https://avatars.discourse-cdn.com/v4/letter/t/839c29/32.png) [@theflakes](https://discuss.elastic.co/u/theflakes)\
**Post date:** [July 2, 2020, 9:15pm UTC](https://discuss.elastic.co/t/dissect-json-array-of-strings/239711/1 "2020-07-02T21:15:51Z")

</div>

I have a Json array of strings. I want to find the one entry that starts with “xx” and create a new field with it as the value. The text after “xx” can vary.

Not sure how to use the dissect directive on an array of strings to do this.

Example Json log:  
`{“array”:[“blah”, “not this”, “xxThis”,”not this either”]}`

Result:  
`{“array”:[“blah”, “not this”, ”not this either”], “new_field”:”xxThis”}`

Thanks

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 2, 2020, 9:54pm UTC](https://discuss.elastic.co/t/dissect-json-array-of-strings/239711/2 "2020-07-02T21:54:52Z")

</div>

I would do that in a ruby filter. I have not tested it but something like

```
ruby {
    code => '
        a = event.get("array")
        if a
            a.each { |x|
                if x =~ /^xx/
                    event.set("new_field", x)
                end
            }
        end
    '
}
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 30, 2020, 9:54pm UTC](https://discuss.elastic.co/t/dissect-json-array-of-strings/239711/3 "2020-07-30T21:54:57Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.