# Dynamic field names in logstash **URL:** \ **Category:** Logstash\ **Created:** [April 11, 2017, 12:10pm UTC](https://discuss.elastic.co/t/dynamic-field-names-in-logstash/81981 "2017-04-11T12:10:14Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Aditya\_Srivastava](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aditya_srivastava/32/43287_2.png) [@Aditya\_Srivastava](https://discuss.elastic.co/u/Aditya_Srivastava)\ **Post date:** [April 11, 2017, 12:10pm UTC](https://discuss.elastic.co/t/dynamic-field-names-in-logstash/81981/1 "2017-04-11T12:10:14Z")
I have a string which is dynamic .It represents resp time and ip address 60.006,0.001#10.10.24.14:8082,10.10.22.11:8082 The no of machine can grow and so will the subsequent resp time and ip address. What I am trying is to split the string first on the basis of '#' and then on the basis of ',' and store the values. The code I have written in ruby is ruby { code =\> " fields = event['data'].split('#') for field in fields field = field.split(',') event['respTime1'] = field[0] event['respTime2'] = field[1] end " } Can someone explain or tell how to make the fields dynamic so that if I have 100 different servers resp time & IP address, I can use dynamic names for it ---
**Author:** ![paz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/paz/32/28003_2.png) [@paz](https://discuss.elastic.co/u/paz)\ **Post date:** [April 11, 2017, 1:49pm UTC](https://discuss.elastic.co/t/dynamic-field-names-in-logstash/81981/2 "2017-04-11T13:49:38Z")
I've probably mis-interpreted your expected outcome, but the code below `ruby { code => " times, hosts = event['data'].split('#') hosts.split(',').each_with_index { |val,index| event['respTime' + (index+1).to_s] = times.split(',')[index] } " }` would yield ```auto event["respTime1"]=>"60.006" event["respTime2"]=>"0.001" ``` Is that what you're after? If not, could you please post an expected output with actual values? Edit: If you're after Host:Time pairs, which seems more logical, the snippet below ```auto ruby { code => " times, hosts = event['data'].split('#') hosts.split(',').each_with_index { |val,index| event[val.to_s] = times.split(',')[index] } " } ``` will return ```auto "10.10.24.14:8082"=>"60.006" "10.10.22.11:8082"=>"0.001" ``` ---
**Author:** ![Aditya\_Srivastava](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aditya_srivastava/32/43287_2.png) [@Aditya\_Srivastava](https://discuss.elastic.co/u/Aditya_Srivastava)\ **Post date:** [April 11, 2017, 2:06pm UTC](https://discuss.elastic.co/t/dynamic-field-names-in-logstash/81981/3 "2017-04-11T14:06:38Z")
Thank you so much for your reply. The output I am expecting is "respTime\_1" =\> "60.006" "respTime\_2" =\> "0.001" "IP\_1" =\> "10.10.24.14:8082" "IP\_2" =\> "10.10.22.11:8082" And \_1 and \_2 in the field have to be dynamic like if I have 5 inputs so o/p should be like "respTime\_1" =\> "60.006" "respTime\_2" =\> "64" "respTime\_3" =\> "63" "respTime\_4" =\> "62" "respTime\_5" =\> "61" ---
**Author:** ![paz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/paz/32/28003_2.png) [@paz](https://discuss.elastic.co/u/paz)\ **Post date:** [April 11, 2017, 2:16pm UTC](https://discuss.elastic.co/t/dynamic-field-names-in-logstash/81981/4 "2017-04-11T14:16:42Z")
Ah, alright. You can try this then ```auto ruby { code => " # splits the data field into 2 arrays, times and hosts times, hosts = event['data'].split('#') # split times on each , character and for every value create a field named with a respTime_ prefix and incremental values based on array index (plus 1, since index starts at 0). times.split(',').each_with_index { |val,index| event['respTime_' + (index+1).to_s] = val} # same process for hosts array, creating the IP_ fields. hosts.split(',').each_with_index { |val,index| event['IP_' + (index+1).to_s] = val} " } ``` It will create the appropriate fields for any amount of included entries. ---
**Author:** ![Aditya\_Srivastava](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aditya_srivastava/32/43287_2.png) [@Aditya\_Srivastava](https://discuss.elastic.co/u/Aditya_Srivastava)\ **Post date:** [April 11, 2017, 2:53pm UTC](https://discuss.elastic.co/t/dynamic-field-names-in-logstash/81981/5 "2017-04-11T14:53:13Z")
Thank you so much....Exactly the same code I was looking for.. Can you please explain below line of the code. each\_with\_index { |val,index| event['respTime\_' + (index+1).to\_s] = val ---
**Author:** ![paz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/paz/32/28003_2.png) [@paz](https://discuss.elastic.co/u/paz)\ **Post date:** [April 11, 2017, 3:04pm UTC](https://discuss.elastic.co/t/dynamic-field-names-in-logstash/81981/6 "2017-04-11T15:04:12Z")
Sure thing, **each\_with\_index** : is an iterator (basically a loop) where for each array object, it returns it's value and it's position (_index_). More info : [https://apidock.com/ruby/Enumerator/each\_with\_index](https://apidock.com/ruby/Enumerator/each_with_index) **|val,index|** : defines the names of the returned variables. **event['respTime\_' + (index+1).to\_s** : this takes the index number, increments it by 1 (because index starts at 0 and we want the first field to be respTime\_1 instead of respTime\_0), converts it to string with **.to\_s** and joins it with the **respTime\_** prefix, creating the field name. **= val** just puts the value we got from the iterator as the field value. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 9, 2017, 3:18pm UTC](https://discuss.elastic.co/t/dynamic-field-names-in-logstash/81981/7 "2017-05-09T15:18:55Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.