# How to concatenate fields inside an array using Logstash?

**URL:** <https://discuss.elastic.co/t/how-to-concatenate-fields-inside-an-array-using-logstash/100148>\
**Category:** Logstash\
**Created:** [September 12, 2017, 2:06am UTC](https://discuss.elastic.co/t/how-to-concatenate-fields-inside-an-array-using-logstash/100148 "2017-09-12T02:06:44Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![amruth](https://avatars.discourse-cdn.com/v4/letter/a/43a26b/32.png) [@amruth](https://discuss.elastic.co/u/amruth)\
**Post date:** [September 12, 2017, 2:06am UTC](https://discuss.elastic.co/t/how-to-concatenate-fields-inside-an-array-using-logstash/100148/1 "2017-09-12T02:06:44Z")

</div>

Hi,

I am trying to concatenate fields inside an array. For example,

```
    event_data => {
    param1 => "request",
    param2 => "is signing off"
    }

```

And fields inside event\_data may vary. For example it may be param1,param2,param3 and so on. I am trying to comcatenate all the fields(no matter how many fields)into a single field. Can someone please help me on this?

Thanks

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 12, 2017, 6:01am UTC](https://discuss.elastic.co/t/how-to-concatenate-fields-inside-an-array-using-logstash/100148/2 "2017-09-12T06:01:39Z")

</div>

That's not an array, it's a hash or an object depending on which terminology you want to stick to.

You'll have to use a ruby filter. If you don't care about the names of the keys, just the values, this piece of Ruby should work:

```
event.set('some-field-name', event.get('event_data').values.sort.join(','))
```

---

<div class="post-metadata">

**Author:** ![amruth](https://avatars.discourse-cdn.com/v4/letter/a/43a26b/32.png) [@amruth](https://discuss.elastic.co/u/amruth)\
**Post date:** [September 12, 2017, 11:07am UTC](https://discuss.elastic.co/t/how-to-concatenate-fields-inside-an-array-using-logstash/100148/3 "2017-09-12T11:07:52Z")

</div>

Thanks Magnus, will try it. But how to know whether Ruby(for that matter any plugin) is supported or not on my installed Logstash? And if not supported, how to install the plugin?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 13, 2017, 11:31am UTC](https://discuss.elastic.co/t/how-to-concatenate-fields-inside-an-array-using-logstash/100148/4 "2017-09-13T11:31:23Z")

</div>

The logstash-plugin command can e.g. list installed plugins and install new ones.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 11, 2017, 11:31am UTC](https://discuss.elastic.co/t/how-to-concatenate-fields-inside-an-array-using-logstash/100148/5 "2017-10-11T11:31:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.