# Flatten array in Logstash

**URL:** <https://discuss.elastic.co/t/flatten-array-in-logstash/151850>\
**Category:** Logstash\
**Created:** [October 10, 2018, 12:51pm UTC](https://discuss.elastic.co/t/flatten-array-in-logstash/151850 "2018-10-10T12:51:49Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![pastechecker](https://avatars.discourse-cdn.com/v4/letter/p/0ea827/32.png) [@pastechecker](https://discuss.elastic.co/u/pastechecker)\
**Post date:** [October 10, 2018, 12:51pm UTC](https://discuss.elastic.co/t/flatten-array-in-logstash/151850/1 "2018-10-10T12:51:49Z")

</div>

I am attempting to extract new values from array keys `[files][MD5]` and create a new field for `md5_hashes` that will contain the array keys.

Input:

> "files": [{  
> "SHA256": "1213447D713ECA24484983E754474D9D2F4A283D77DDBD9C8084CD7AA0574ACF",  
> "MD5": "7D332F11DD7389C8121AA523F07CFEEC",  
> "SHA1": "6026B28C6049115272138AD357A5AF67B99354A5"  
> }, {  
> "SHA256": "1213447D713ECA24484983E754474D9D2F4A283D77DDBD9C8084CD7AA0574ACF",  
> "MD5": "7D332F11DD7389C8121AA523F07CFEEC",  
> "SHA1": "6026B28C6049115272138AD357A5AF67B99354A5"  
> }, {  
> "SHA256": "1212447D713ECA24484983E754474D9D2F4A283D77DDBD9C8084CD7AA0574ACF",  
> "MD5": "7D332F11DD7389C8121AA523F07CFEEC",  
> "SHA1": "6026B28C6049115272138AD357A5AF67B99354A5"  
> }  
> ]

Expected output:

> "md5\_hashes":["7D332F11DD7389C8121AA523F07CFEEC","7D332F11DD7389C8121AA523F07CFEEC","7D332F11DD7389C8121AA523F07CFEEC"]

My filter:

> mutate {add\_field =\> {"md5\_hashes" =\> "%{[files][MD5]}"}}

another attempt was with:

> ruby {  
> code =\> '  
> a = event.get("files")  
> a.each\_index { |i|  
> event.set("files-#{i}-total", a[i]["MD5"])  
> }  
> '  
> }  
> This solution produces new objects for each MD5, I could kind of use it and merge the values after extracing it from Logstash, but I want to close my solution within Logstash configuration.

Is there a way to accomplish with Logstash 6.4?

---

<div class="post-metadata">

**Author:** ![pastechecker](https://avatars.discourse-cdn.com/v4/letter/p/0ea827/32.png) [@pastechecker](https://discuss.elastic.co/u/pastechecker)\
**Post date:** [October 10, 2018, 2:03pm UTC](https://discuss.elastic.co/t/flatten-array-in-logstash/151850/2 "2018-10-10T14:03:44Z")

</div>

Working code:

> ruby {  
> code =\> 'a = event.get("files"); event.set("md5\_hashes", a.map { |e| e["MD5"] })'  
> }

However I still get lots of errors:

> [2018-10-10T15:48:18,431][ERROR][logstash.filters.ruby] Ruby exception occurred: undefined method `map' for nil:NilClass --\> caused probably by the attempt to parse something that does contain "files", but does not contain "files":[{"MD5"}]  
> [2018-10-10T15:47:51,820][ERROR][logstash.filters.ruby] Ruby exception occurred: no implicit conversion of String into Integer --\> I do not know yet from where does it coming from.

---

<div class="post-metadata">

**Author:** ![pastechecker](https://avatars.discourse-cdn.com/v4/letter/p/0ea827/32.png) [@pastechecker](https://discuss.elastic.co/u/pastechecker)\
**Post date:** [October 10, 2018, 2:08pm UTC](https://discuss.elastic.co/t/flatten-array-in-logstash/151850/3 "2018-10-10T14:08:09Z")

</div>

This error line related with NilClass was removed by applying to the filter before:

> if [files][MD5]{  
> ruby {  
> code =\> 'a = event.get("files"); event.set("files\_md5", a.map { |e| e["MD5"] })'  
> }  
> }

ERROR line:

> [2018-10-10T15:48:18,431][ERROR][logstash.filters.ruby] Ruby exception occurred: undefined method `map' for nil:NilClass

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 7, 2018, 2:08pm UTC](https://discuss.elastic.co/t/flatten-array-in-logstash/151850/4 "2018-11-07T14:08:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.