# Help requested to iterate and join sub-arrays
**URL:** https://discuss.elastic.co/t/help-requested-to-iterate-and-join-sub-arrays/352408
**Category:** Logstash
**Created:** [February 2, 2024, 1:49pm UTC](https://discuss.elastic.co/t/help-requested-to-iterate-and-join-sub-arrays/352408 "2024-02-02T13:49:16Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@lmw](https://discuss.elastic.co/u/lmw)
#### Post date: [February 2, 2024, 1:49pm UTC](https://discuss.elastic.co/t/help-requested-to-iterate-and-join-sub-arrays/352408/1 "2024-02-02T13:49:16Z")
Hi everyone,
Please forgive me for my noob question, of it it has already been answered, but I have not been able to find it by myself.
Let's consider that I have this datasource, with an arrays of `vars`, which may contain arbitrary `content` which can be of type `array` or `string`:
```auto
"nodelog": {
"body": {
"email": "xxxxxxxxxxxx@gmail.com",
"template": "Alertxxxxxxxxxx",
"vars": [{
"name": "users",
"content": [{
"item1": "value1",
"item2": "value2",
"user_id": "daba4a95-c585-4001-9195-351fd859914b",
"value_id": "154770",
"last_change": "2024-01-25T14:30:49.382Z"
}
],
[{
"item1": "value10",
"item2": "value20",
"user_id": "54678945-c585-4001-9195-351fd859914b",
"value_id": "654789",
"last_change": "2024-01-22T12:30:40.123Z"
}
]
}, {
"name": "CRON_JOB",
"content": "control-users"
}, {
"name": "GENERIC_TEXT",
"content": "lorem ipsum..."
}
]
},
},
```
What I am looking for is to iterate through any found item of `vars` and systematically convert each `content` to a string representation.
For the example above, I am trying to build something like this using logstash pipeline:
```auto
"nodelog": {
"body": {
"email": "xxxxxxxxxxxx@gmail.com",
"template": "Alertxxxxxxxxxx",
"vars": [{
"name": "users",
"content": "{ \"item1\": \"value1\", \"item2\": \"value2\", \"user_id\": \"daba4a95-c585-4001-9195-351fd859914b\", \"value_id\": \"154770\", \"last_change\": \"2024-01-25T14:30:49.382Z\" },{ \"item1\": \"value10\", \"item2\": \"value20\", \"user_id\": \"value_id\": \"654789\", \"last_change\": \"2024-01-22T12:30:40.123Z\" }"
}, {
"name": "CRON_JOB",
"content": "control-users"
}, {
"name": "GENERIC_TEXT",
"content": "lorem ipsum..."
}
]
},
},
```
I guess that I should use a mutate filter, with maybe the [join](https://www.elastic.co/guide/en/logstash/8.12/plugins-filters-mutate.html#plugins-filters-mutate-join) operation, but I don't know if I have to use a block of ruby code (_which I never used before_) to iterate though the `vars` array, or if there is a simpler way to address all the `content` values in one way.
Would that be possible to write something like this, even if `vars` is an array?
```auto
mutate {
join => { "[nodelog][body][vars][content]" => "," }
}
```
Any help or guideline would be greatly appreciated.
Thanks in advance
Louis
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [February 2, 2024, 6:07pm UTC](https://discuss.elastic.co/t/help-requested-to-iterate-and-join-sub-arrays/352408/2 "2024-02-02T18:07:12Z")
Your JSON is not valid. "content" cannot be a list of arrays. It could be an array of arrays. It could be an array of hashes. You need to show us valid JSON that you want to reconfigure.
If it is an array of hashes then you could try
```
ruby {
code => '
vars = event.get("[nodelog][body][vars]")
if vars.respond_to? "each_index"
vars.each_index { |x|
if vars[x]["content"].respond_to? "each_index"
newContent = ""
vars[x]["content"].each_index { |y|
newContent += vars[x]["content"][y].to_s + ","
}
newContent.delete_suffix!(",")
event.set("[nodelog][body][vars][#{x}][content]", newContent)
end
}
end
'
}
```
---
### Author:  [@lmw](https://discuss.elastic.co/u/lmw)
#### Post date: [February 2, 2024, 6:25pm UTC](https://discuss.elastic.co/t/help-requested-to-iterate-and-join-sub-arrays/352408/3 "2024-02-02T18:25:48Z")
Hi Badger,
Ah, yes, you're right.
I am sorry, it is a copy/paste mistake.
Here is the right initial content:
```auto
"nodelog": {
"body": {
"email": "xxxxxxxxxxxx@gmail.com",
"template": "Alertxxxxxxxxxx",
"vars": [{
"name": "users",
"content": [{
"item1": "value1",
"item2": "value2",
"user_id": "daba4a95-c585-4001-9195-351fd859914b",
"value_id": "154770",
"last_change": "2024-01-25T14:30:49.382Z"
},
{
"item1": "value10",
"item2": "value20",
"user_id": "54678945-c585-4001-9195-351fd859914b",
"value_id": "654789",
"last_change": "2024-01-22T12:30:40.123Z"
}
]
}, {
"name": "CRON_JOB",
"content": "control-users"
}, {
"name": "GENERIC_TEXT",
"content": "lorem ipsum..."
}
]
},
},
```
Thanks for pointing this.
Louis-Marie
---
### Author:  [@lmw](https://discuss.elastic.co/u/lmw)
#### Post date: [February 7, 2024, 11:31am UTC](https://discuss.elastic.co/t/help-requested-to-iterate-and-join-sub-arrays/352408/4 "2024-02-07T11:31:17Z")
Any help please?
Thanks in advance
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [February 7, 2024, 6:25pm UTC](https://discuss.elastic.co/t/help-requested-to-iterate-and-join-sub-arrays/352408/5 "2024-02-07T18:25:09Z")
What you posted is still not valid standalone JSON. If I use
```
{ "nodelog": {
"body": {
"email": "xxxxxxxxxxxx@gmail.com",
"template": "Alertxxxxxxxxxx",
"vars": [{
"name": "users",
"content": [{
"item1": "value1",
"item2": "value2",
"user_id": "daba4a95-c585-4001-9195-351fd859914b",
"value_id": "154770",
"last_change": "2024-01-25T14:30:49.382Z"
},
{
"item1": "value10",
"item2": "value20",
"user_id": "54678945-c585-4001-9195-351fd859914b",
"value_id": "654789",
"last_change": "2024-01-22T12:30:40.123Z"
}
]
}, {
"name": "CRON_JOB",
"content": "control-users"
}, {
"name": "GENERIC_TEXT",
"content": "lorem ipsum..."
}
]
}
}}
```
and run the ruby filter I posted then it produces what you asked for.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 6, 2024, 6:25pm UTC](https://discuss.elastic.co/t/help-requested-to-iterate-and-join-sub-arrays/352408/6 "2024-03-06T18:25:41Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.