# How access nested array field from wmibeat

**URL:** <https://discuss.elastic.co/t/how-access-nested-array-field-from-wmibeat/154707>\
**Category:** Elasticsearch\
**Created:** [October 30, 2018, 6:09pm UTC](https://discuss.elastic.co/t/how-access-nested-array-field-from-wmibeat/154707 "2018-10-30T18:09:13Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![fionamacd](https://avatars.discourse-cdn.com/v4/letter/f/6a8cbe/32.png) [@fionamacd](https://discuss.elastic.co/u/fionamacd)\
**Post date:** [October 30, 2018, 6:09pm UTC](https://discuss.elastic.co/t/how-access-nested-array-field-from-wmibeat/154707/1 "2018-10-30T18:09:14Z")

</div>

Hi,  
I am sending wmibeat to logstash and want to change the value of the field returned from string to number. I would normally do this with a mutate or grok in filter section, but I can't seem to get the field parsed correctly.

This is how it looks in Kibana:  
wmi.Win32\_Process.0.VirtualSize 35568685056

I thought this would work, but it doesn't:  
filter {  
mutate {  
add\_field =\> { "Bytes" =\> "%{[wmi][Win32\_Process].0.[VirtualSize]}" }  
convert =\> { "Bytes" =\> "float" }  
}  
}

The output from this is a new field called Bytes with the text above in it:  
Bytes %{[wmi][Win32\_Process].0.[VirtualSize]}

I have tried various formats of square brackets, using comma notation instead of square brackets, I even tried deciphering the ruby code, but I got completely lost with that. All I want is to convert the field content to a number instead of a string. What am I missing here?

I also run it with debug on and I can see the pipeline event as:  
[DEBUG] 2018-10-30 18:23:59.356 [Ruby-0-Thread-10: :1] pipeline - filter received {"event"=\>{"tags"=\>["production", "fionatest", "wmibeat", "beat", "beats\_input\_raw\_event"], "wmi"=\>{"Win32\_Process"=\>{"0"=\>{"Name"=\>"filebeat.exe", "VirtualSize"=\>"35568685056"}}}, "@timestamp"=\>2018-10-30T18:23:54.943Z, "beat"=\>{"name"=\>"WIN-95VPU63HK0H", "hostname"=\>"WIN-95VPU63HK0H"}, "type"=\>"wmibeat", "host"=\>"WIN-95VPU63HK0H", "@version"=\>"1"}}

---

<div class="post-metadata">

**Author:** ![jakelandis](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jakelandis/32/36163_2.png) [@jakelandis](https://discuss.elastic.co/u/jakelandis)\
**Post date:** [October 30, 2018, 7:23pm UTC](https://discuss.elastic.co/t/how-access-nested-array-field-from-wmibeat/154707/2 "2018-10-30T19:23:52Z")

</div>

I think this is what you want:

```auto
  mutate {
 	add_field => { "Bytes" => "%{[wmi][Win32_Process][0][VirtualSize]}" }
  } 
  mutate {
	convert => { "Bytes" => "integer" }
  }

```

The syntax is `[0]` not `.0.`. Also, you need to use two filters here to ensure that add\_field happens before the convert. Also, converting to integer type instead of float since I assume there bytes are integer/long types.

For future Logstash questions please see the #logstash topic.

---

<div class="post-metadata">

**Author:** ![fionamacd](https://avatars.discourse-cdn.com/v4/letter/f/6a8cbe/32.png) [@fionamacd](https://discuss.elastic.co/u/fionamacd)\
**Post date:** [October 30, 2018, 10:20pm UTC](https://discuss.elastic.co/t/how-access-nested-array-field-from-wmibeat/154707/3 "2018-10-30T22:20:12Z")

</div>

Re #logstash forum - oops sorry, I think I started a question in that forum and then went off to try something and posted to this one by mistake!

Thanks for your help - I did get this working finally, although the conversion to a non-string field was harder than I thought it would be. I ended up with this:

> filter {  
> mutate {  
> add\_field =\> { "Bytes" =\> "%{[wmi][Win32\_Process][0][VirtualSize]}" }  
> add\_field =\> { "Index\_Type" =\> "wmibeat" }  
> }  
> grok { match =\> { "Bytes" =\> "%{INT:Bytesxxx}" } }  
> ruby { code =\> "event.set('byte2number', event.get('Bytes').to\_f)" }  
> }

I tried the mutate convert but it always gave me a string field.

Anyway, this might not be pretty, but it works 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 27, 2018, 10:20pm UTC](https://discuss.elastic.co/t/how-access-nested-array-field-from-wmibeat/154707/4 "2018-11-27T22:20:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.