# How can I identify new elements in an array via Logstash/Elasticsearch?

**URL:** <https://discuss.elastic.co/t/how-can-i-identify-new-elements-in-an-array-via-logstash-elasticsearch/336105>\
**Category:** Logstash\
**Created:** [June 15, 2023, 2:01pm UTC](https://discuss.elastic.co/t/how-can-i-identify-new-elements-in-an-array-via-logstash-elasticsearch/336105 "2023-06-15T14:01:38Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![SamuelSMendes](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/samuelsmendes/32/104246_2.png) [@SamuelSMendes](https://discuss.elastic.co/u/SamuelSMendes)\
**Post date:** [June 15, 2023, 2:01pm UTC](https://discuss.elastic.co/t/how-can-i-identify-new-elements-in-an-array-via-logstash-elasticsearch/336105/1 "2023-06-15T14:01:38Z")

</div>

For the context, I have an API request that returns a few devices and the apps installed in them. here is an example of what the result looks like in the elasticsearch:

```auto
"hits": [
  {
    "_index": "devices_xxxx",
    "_id": "sjgaopnwcsg4dgjsc",
    "_score": 5.37709,
    "_source": {
      "apps": [
        {
          "version": "1.2.180",
          "name": "app.name.one",
          "identifier": "identifier.one",
          "tags": null,
          "buildNumber": "999",
          "icon": null
        },
        {
          "version": "2.20.50",
          "name": "app.name.two",
          "identifier": "identifier.two",
          "tags": null,
          "buildNumber": "888",
          "icon": null
        },
        {
          "version": "3.2.3",
          "name": "app.name.three",
          "identifier": "identifier.three",
          "tags": null,
          "buildNumber": "786",
          "icon": null
        }
      ],
      "@version": "1",
      "tags": [
        "xxxx"
      ],
      "@timestamp": "2023-06-15T13:07:20.533311369Z",
      "device": {
        "id": "dgobnosdk",
        "organization": "xxxx"
      }
    }
  }

```

This one has three apps but some has 14, 10 even 60+.

What I want to do is, for each device, whenever a new app is added, I am aware of it. The last step will be to notify but I am going one piece at a time. For now I want to get a rule just so I can say that for example:

"The application _app.name.four_ of identifier _identifier.four_ has been installed in the device _dgobnosdk_"

I am open for different ways to approach this, be a Logstash config or a Watcher structure, any help is appreciated.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 13, 2023, 2:02pm UTC](https://discuss.elastic.co/t/how-can-i-identify-new-elements-in-an-array-via-logstash-elasticsearch/336105/2 "2023-07-13T14:02:26Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.