# How to access / address nested fields on Logstash

**URL:** <https://discuss.elastic.co/t/how-to-access-address-nested-fields-on-logstash/241861>\
**Category:** Logstash\
**Created:** [July 20, 2020, 9:08am UTC](https://discuss.elastic.co/t/how-to-access-address-nested-fields-on-logstash/241861 "2020-07-20T09:08:00Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Yoorae\_Kim](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yoorae_kim/32/56310_2.png) [@Yoorae\_Kim](https://discuss.elastic.co/u/Yoorae_Kim)\
**Post date:** [July 20, 2020, 9:08am UTC](https://discuss.elastic.co/t/how-to-access-address-nested-fields-on-logstash/241861/1 "2020-07-20T09:08:00Z")

</div>

Hello, I am currently trying to convert a nested sub field that contains hexadecimal string to an int type field using Logstash filter

```auto
ruby{
    code => 'event.set("[transactions][gasprice_int]", event.get("[transactions][gasPrice]").to_i(16))'
  }

```

but it's returning the error

```auto
[ERROR][logstash.filters.ruby][main][2342d24206691f4db46a60285e910d102a6310e78cf8af43c9a2f1a1d66f58a8] Ruby exception occurred: wrong number of arguments calling `to_i` (given 1, expected 0)

```

This method of conversion of hex-string to int type worked when I wasn't dealing with nested fields, so can anyone please help me how to correctly address nested fields in this case?

btw,

this is the code that still works

```auto
ruby {
    code => 'event.set("difficulty_int", event.get("difficulty").to_i(16))'
  }

```

---

<div class="post-metadata">

**Author:** ![Jenni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jenni/32/29684_2.png) [@Jenni](https://discuss.elastic.co/u/Jenni)\
**Post date:** [July 20, 2020, 1:40pm UTC](https://discuss.elastic.co/t/how-to-access-address-nested-fields-on-logstash/241861/2 "2020-07-20T13:40:45Z")

</div>

That probably has less to do with gasPrice being a subfield and more with it not being the data type you think it is. The function `to_i` on strings supports the parameter to define the base. On other data types it doesn't. If you put the following line before the code for your conversion, what does it say?  
`puts event.get("[transactions][gasPrice]").class.name`

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 20, 2020, 5:15pm UTC](https://discuss.elastic.co/t/how-to-access-address-nested-fields-on-logstash/241861/3 "2020-07-20T17:15:37Z")

</div>

> [@Yoorae\_Kim](#):
>
> `wrong number of arguments calling `to\_i` (given 1, expected 0)`

As Jenni says, this could be because the field does not have the type you think it has. Perhaps

```
event.get("[transactions][gasPrice]").to_s.to_i(16)

```

---

<div class="post-metadata">

**Author:** ![Yoorae\_Kim](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yoorae_kim/32/56310_2.png) [@Yoorae\_Kim](https://discuss.elastic.co/u/Yoorae_Kim)\
**Post date:** [July 21, 2020, 6:17am UTC](https://discuss.elastic.co/t/how-to-access-address-nested-fields-on-logstash/241861/4 "2020-07-21T06:17:18Z")

</div>

It was a string of hexadecimal, and the type of the field was 'keyword'.  
For those of you who are having the same problem, I had multiple elements in 'transactions' field thus had multiple values of 'gasPrice'.  
Looping through each transaction fixed the error.

```auto
transactions_num = event.get("[transactions]").size
      transactions_num.times do |index|
        event.set("[transactions][#{index}][gasprice_int]", event.get("[transactions][#{index}][gasPrice]").to_i(16))
end

```

This is how I fixed it and it worked.

Still, thank you so much for people who left the replies and tried to help!!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 18, 2020, 6:17am UTC](https://discuss.elastic.co/t/how-to-access-address-nested-fields-on-logstash/241861/5 "2020-08-18T06:17:37Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.