# Dynamic fields

**URL:** https://discuss.elastic.co/t/dynamic-fields/35309
**Category:** Logstash
**Created:** [November 23, 2015, 1:51pm UTC](https://discuss.elastic.co/t/dynamic-fields/35309 "2015-11-23T13:51:20Z")
**Posts on this page:** 9
**Page:** 1

<div class="post-metadata">

### Author: ![vikas.saini](https://avatars.discourse-cdn.com/v4/letter/v/87869e/32.png) [@vikas.saini](https://discuss.elastic.co/u/vikas.saini)
#### Post date: [November 23, 2015, 1:51pm UTC](https://discuss.elastic.co/t/dynamic-fields/35309/1 "2015-11-23T13:51:20Z")

</div>

i want a nestod json like this and my fields contains this string  
alice@22#bob@34  
i want this json  
"dataclass":{

"tags":{  
"alice":22,  
"bob":34  
}  
}  
where i am wrong please suggest  
ruby {  
code =\> '  
b = event["fields"].split("#");  
ary = Array.new;  
for c in b ;  
f= c.split("@")[0];  
v=c.split("@")[1];  
event[f]=v;  
event["[dataclass][tags][%{[f]}]"]=v;

```
        end;
    '
}
```

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [November 23, 2015, 1:56pm UTC](https://discuss.elastic.co/t/dynamic-fields/35309/2 "2015-11-23T13:56:59Z")

</div>

You're overcomplicating things by using a ruby filter. You should be able to use a [kv filter](https://www.elastic.co/guide/en/logstash/current/plugins-filters-kv.html). Untested:

```
filter {
  kv {
    source => "fields"
    target => "[dataclass][tags]"
    field_split => "#"
    value_split => "@"
  }
}
```

---

<div class="post-metadata">

### Author: ![vikas.saini](https://avatars.discourse-cdn.com/v4/letter/v/87869e/32.png) [@vikas.saini](https://discuss.elastic.co/u/vikas.saini)
#### Post date: [November 23, 2015, 2:18pm UTC](https://discuss.elastic.co/t/dynamic-fields/35309/3 "2015-11-23T14:18:09Z")

</div>

but thing is that i want to check in ruby if a field is number then convert it into integer .how can this i do into kv .  
as you answered it will take 22 and 34 as string ,how can i convert them into integers ?

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [November 23, 2015, 2:29pm UTC](https://discuss.elastic.co/t/dynamic-fields/35309/4 "2015-11-23T14:29:08Z")

</div>

Oh, I didn't read all of the code. Then perhaps use kv for splitting the string and a ruby filter for conditionally converting the fields?

---

<div class="post-metadata">

### Author: ![vikas.saini](https://avatars.discourse-cdn.com/v4/letter/v/87869e/32.png) [@vikas.saini](https://discuss.elastic.co/u/vikas.saini)
#### Post date: [November 23, 2015, 2:35pm UTC](https://discuss.elastic.co/t/dynamic-fields/35309/5 "2015-11-23T14:35:25Z")

</div>

magnus please if you don't mind look at my code again ,i am really stuck how that json can be made using ruby filter .  
Til now i can do this .  
ruby {  
code =\> '  
b = event["fields"].split("#");  
ary = Array.new;  
for c in b ;  
f= c.split("@")[0];  
v=c.split("@")[1];  
if v =~ /\A\d+\Z/  
event[f] = v.to\_i  
else  
event[f] = v  
end

```
        end;
       
    '
}

```

But the result is that i am not able to get all those key value pairs viz "alice":22 and "bob":34 inside the fields can i use source inside the code block so that these pairs dont add to root .  
as i am splitting the string you can understand that my string is dynamic and can include both string and integer values .so i don't know to which to convert to what .

---

<div class="post-metadata">

### Author: ![vikas.saini](https://avatars.discourse-cdn.com/v4/letter/v/87869e/32.png) [@vikas.saini](https://discuss.elastic.co/u/vikas.saini)
#### Post date: [November 30, 2015, 6:59am UTC](https://discuss.elastic.co/t/dynamic-fields/35309/6 "2015-11-30T06:59:10Z")

</div>

please suggest something i am still stuck !

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [November 30, 2015, 7:08am UTC](https://discuss.elastic.co/t/dynamic-fields/35309/7 "2015-11-30T07:08:15Z")

</div>

If you're having problems writing Ruby code, perhaps you should reduce the amount of Ruby code you need to write by using the kv filter to do the splitting and parsing and using Ruby only to convert the field values to integers?

---

<div class="post-metadata">

### Author: ![vikas.saini](https://avatars.discourse-cdn.com/v4/letter/v/87869e/32.png) [@vikas.saini](https://discuss.elastic.co/u/vikas.saini)
#### Post date: [November 30, 2015, 7:14am UTC](https://discuss.elastic.co/t/dynamic-fields/35309/8 "2015-11-30T07:14:42Z")

</div>

ruby {  
code =\> '  
b = event["fields"].split("#");  
ary = Array.new;  
for c in b ;  
f= c.split("@")[0];  
v=c.split("@")[1];  
if v =~ /\A\d+\Z/  
event[f] = v.to\_i  
else  
event[f] = v  
end  
event["[dataclass][tags][f]"]=v;  
this is my ruby code  
and thing i am trying to do is create json like  
suppose "f" contains field1,field2 as i extracted it from fields string  
"dataclass":{  
"tags":{  
"field1":23,  
"field2":"text"  
}  
}

problem i am having is in [dataclass][tags][f] "f " is not working

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:20am UTC](https://discuss.elastic.co/t/dynamic-fields/35309/9 "2017-07-06T05:20:50Z")

</div>


