# Getting key value from nested "event" element

**URL:** <https://discuss.elastic.co/t/getting-key-value-from-nested-event-element/107852>\
**Category:** Logstash\
**Created:** [November 16, 2017, 3:02am UTC](https://discuss.elastic.co/t/getting-key-value-from-nested-event-element/107852 "2017-11-16T03:02:10Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![danielmcquillen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/danielmcquillen/32/23536_2.png) [@danielmcquillen](https://discuss.elastic.co/u/danielmcquillen)\
**Post date:** [November 16, 2017, 3:02am UTC](https://discuss.elastic.co/t/getting-key-value-from-nested-event-element/107852/1 "2017-11-16T03:02:10Z")

</div>

This one has me stumped, and I wonder if there's a subtlety I'm missing.

I have an (unfortunately structured) log event that records an 'assessment' attempt in our learning management system. It looks something like this:

```auto
{
  "foo": "bar",
  ...some more top level key/values...
  "event": {
     "submitted_answer": {
        "Q1": {
            ... details on Q1
       }
    }
}

```

I want to read in the first key string "Q1" and assign it as a value somewhere so I can use it more easily in Kibana. That Q1 is really the ID of an assessment so I'd much rather have something like `"question_id":"Q1"` at the top level of the document.

However, each method I've tried to grab that "Q1" value (or whatever value it is, e.g. "Q2","Q3") doesn't seem to work.

My most recent try looks like this:

```auto
filter {
      ruby {
            code => "
                sa = event.get([event][submitted_answer])
                event.set('question_id', sa.keys[0])
            "
        }
}

```

Which gives me the error...

```auto
Ruby exception occurred: undefined local variable or method `submitted_answer' for #<LogStash::Filters::Ruby:0x4236042c>

```

I wonder if the internal key string "event" is somehow confusing the event api?

As an aside, I wanted to rename that "event" key to something more sane -- I thought I should do something like this:

```auto
mutate {
    rename => { "[event]" => "pb_event"}
}

```

But I actually have to do something like this:

```auto
mutate {
            rename => { "[event][event]" => "pb_event"}
        }

```

So then trying to apply that lesson to my ruby code, like this:

```auto
ruby {
            code => "
                sa = event.get([event][event][submitted_answer])
                event.set('question_id', sa.keys[0])
            "
        }

```

Gives me a different error:

```auto
Ruby exception occurred: can't convert LogStash::Event into Integer

```

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 16, 2017, 6:33am UTC](https://discuss.elastic.co/t/getting-key-value-from-nested-event-element/107852/2 "2017-11-16T06:33:52Z")

</div>

> ```
> sa = event.get([event][submitted_answer])
> 
> ```

You need to quote the field name:

```
            sa = event.get('[event][submitted_answer]')

```

---

<div class="post-metadata">

**Author:** ![danielmcquillen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/danielmcquillen/32/23536_2.png) [@danielmcquillen](https://discuss.elastic.co/u/danielmcquillen)\
**Post date:** [November 17, 2017, 1:37am UTC](https://discuss.elastic.co/t/getting-key-value-from-nested-event-element/107852/3 "2017-11-17T01:37:19Z")

</div>

Aha! Thanks for the help, Magnus.

However, it turns out I have to reference the top level event in the argument, like:

```auto
 ruby {
            code => "
                sa = event.get('[event][event][submitted_answer]')
                event.set('question_id', sa.keys[0])
            "
        }

```

Which is interesting as it doesn't seem consistent: I would have thought by calling a method on "event" I wouldn't have to refer to the parent "event" it in the string.

If I get some other value I don't think I have to...e.g. if I get 'foo' from my example above, it's `event.get('[foo]')` not `event.get('[event][foo]')`

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 17, 2017, 6:14am UTC](https://discuss.elastic.co/t/getting-key-value-from-nested-event-element/107852/4 "2017-11-17T06:14:01Z")

</div>

> Which is interesting as it doesn't seem consistent: I would have thought by calling a method on "event" I wouldn't have to refer to the parent "event" it in the string.

That doesn't make any sense. What does a raw event look like? Use a `stdout { codec => rubydebug }` output.

---

<div class="post-metadata">

**Author:** ![danielmcquillen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/danielmcquillen/32/23536_2.png) [@danielmcquillen](https://discuss.elastic.co/u/danielmcquillen)\
**Post date:** [November 22, 2017, 12:42am UTC](https://discuss.elastic.co/t/getting-key-value-from-nested-event-element/107852/5 "2017-11-22T00:42:29Z")

</div>

Yes! You're right. It doesn't make sense.

It turns out an Open edX component was sending me some events where an [event] child property was incorrectly duplicated at [event][event]...but only sometimes, which is why I didn't see it in the log entries I checked and therefore thought it was due to my Logstash code.

Thanks once again.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 20, 2017, 12:42am UTC](https://discuss.elastic.co/t/getting-key-value-from-nested-event-element/107852/6 "2017-12-20T00:42:59Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.