# Filtering and output the first item to elastic **URL:** \ **Category:** Logstash\ **Created:** [June 18, 2020, 12:24pm UTC](https://discuss.elastic.co/t/filtering-and-output-the-first-item-to-elastic/237630 "2020-06-18T12:24:26Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![kileou78](https://avatars.discourse-cdn.com/v4/letter/k/94ad74/32.png) [@kileou78](https://discuss.elastic.co/u/kileou78)\ **Post date:** [June 18, 2020, 12:24pm UTC](https://discuss.elastic.co/t/filtering-and-output-the-first-item-to-elastic/237630/1 "2020-06-18T12:24:26Z")
Hi everybody I'm collecting using an API and filebeat a list of computer's status OK or KO I would like to store on elastic a global status for this group of computer My list is sorted by state, "0" for OK and "2" for KO My current solution is to use any logstash possibility (filtering perhaps) to extract the first computer status and send it to elastic. if i have one state = 2 in my list, my global status will be KO if any state =2 i will send status = 0 to elastic Please find below the details : this is the result of my query sent to logstash using filebeat ```auto [ { "host_name" : "computer2", "last_check" : 1592473989, "state" : 2 }, { "host_name" : "Computer99", "last_check" : 1592473793, "state" : 0 } etc... ] ``` this is my logstash context ```auto input { beats { codec => json port => 5002 tags => ["mytag"] } } filter { date { timezone => "UTC" match => ["last_check","UNIX"] target => "@timestamp" } } output { elasticsearch { hosts => ["myelasticsearch:9200"] index => "logstash-filebeat-%{+YYYY.MM.dd}" } } ``` I would like as a result sent to elastic the following. (only the first item) ```auto [ { "host_name" : "computer2", "last_check" : 1592473989, "state" : 2 } ] ``` Your help will be very usefull for me, I've tried so many things at the moment. Thanks very much in advance! Best Regards Thierry ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [June 18, 2020, 3:04pm UTC](https://discuss.elastic.co/t/filtering-and-output-the-first-item-to-elastic/237630/2 "2020-06-18T15:04:22Z")
> [@kileou78](#): > > if i have one state = 2 in my list, my global status will be KO > if any state =2 i will send status = 0 to elastic These two seem to be in conflict to me. ---
**Author:** ![kileou78](https://avatars.discourse-cdn.com/v4/letter/k/94ad74/32.png) [@kileou78](https://discuss.elastic.co/u/kileou78)\ **Post date:** [June 18, 2020, 4:27pm UTC](https://discuss.elastic.co/t/filtering-and-output-the-first-item-to-elastic/237630/3 "2020-06-18T16:27:47Z")
Hi badger Thanks for your time for reading my post To try to explain much better As i'm sorting my result by status, the first entry in the list will show the global status i'm expecting for the group of computer belonging to my query. If i have one status "2" or more in my list. i would like to send one information to elastic with a status 2 If not all the list will contain a status "0" so the first entry will have a status 0. Information that i would like to send also to elastic. The best method i have imagine is to sent the first entry in my list by filtering the list using logstash. If you know any simple way to do that, this will be a good improvment for me. Thanks ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [June 18, 2020, 5:00pm UTC](https://discuss.elastic.co/t/filtering-and-output-the-first-item-to-elastic/237630/4 "2020-06-18T17:00:30Z")
If you want to select the first item of the array [someField] you can use ``` mutate { add_field => { "someOtherField" => "[someField][0]" } } ``` ---
**Author:** ![kileou78](https://avatars.discourse-cdn.com/v4/letter/k/94ad74/32.png) [@kileou78](https://discuss.elastic.co/u/kileou78)\ **Post date:** [June 19, 2020, 8:51am UTC](https://discuss.elastic.co/t/filtering-and-output-the-first-item-to-elastic/237630/5 "2020-06-19T08:51:59Z")
if my understanding is good. ive done some test also. Perhaps i should have used "object" instead of "item". Sorry for that. Your approach consist to add a field in each object "Someotherfield" and link to it the first item in an array called "somefield" this could be a solution if i had the following and would like to select the first state in my list ```auto [ { "host_name" : "computer2", "last_check" : 1592473989, "state" : ["0", "1", "3"] }, { "host_name" : "computer99", "last_check" : 1592473989, "state" : ["1", "0", "3"] } ] ``` the result will be in my case to send to elastic one entry by object with a new field in each object. the goal i would have is to record only the first objet as an input or remove all object except the first one ```auto [ { "host_name" : "computer2", "last_check" : 1592473989, "state" : 2 } ] ``` I think we are close to find the solution 🙂 ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 17, 2020, 8:52am UTC](https://discuss.elastic.co/t/filtering-and-output-the-first-item-to-elastic/237630/6 "2020-07-17T08:52:00Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.