### Author:  [@Jenni](https://discuss.elastic.co/u/Jenni)
#### Post date: [July 21, 2020, 7:16pm UTC](https://discuss.elastic.co/t/how-to-create-key-value-from-nested-fields/242084/4 "2020-07-21T19:16:01Z")
Do you really want this as one large semicolon separated string or do you want this:
> [@Split array with key+value fields to key: value - Follow up](https://discuss.elastic.co/t/split-array-with-key-value-fields-to-key-value-follow-up/240469):
>
> Hello, I am trying to convert this input { "request": { "time": "2020-04-30T07:32:13.997Z", "size": "0", "headers": [ { "key": "Correlation-Id", "value": "124f4cdf-6cd7-44ae-a8dc-2ecf2b187f42" }, { "key": "host", "value": "api.local.host" }, { "key": "x-forwarded-for", "value": "1.1.1.1" }, { "key": "x-forwarded-port", "value": "443" …
?
---
### Author:  [@Ramalakshmi](https://discuss.elastic.co/u/Ramalakshmi)
#### Post date: [July 21, 2020, 7:20pm UTC](https://discuss.elastic.co/t/how-to-create-key-value-from-nested-fields/242084/5 "2020-07-21T19:20:07Z")
I want the field as key+value into key:value separated by semicolon with in one field only.
---
### Author:  [@Jenni](https://discuss.elastic.co/u/Jenni)
#### Post date: [July 21, 2020, 7:29pm UTC](https://discuss.elastic.co/t/how-to-create-key-value-from-nested-fields/242084/6 "2020-07-21T19:29:04Z")
I'm not at a computer and can't test anything. So my quick suggestion would be to do the same as in the link I had posted and then flatten the hash like this:
>
But there's probably a prettier solution 🙂
---
### Author:  [@Ramalakshmi](https://discuss.elastic.co/u/Ramalakshmi)
#### Post date: [July 21, 2020, 7:33pm UTC](https://discuss.elastic.co/t/how-to-create-key-value-from-nested-fields/242084/7 "2020-07-21T19:33:58Z")
Using ruby code in my logstash for what you suggested in the link
---
### Author:  [@Ramalakshmi](https://discuss.elastic.co/u/Ramalakshmi)
#### Post date: [July 21, 2020, 7:51pm UTC](https://discuss.elastic.co/t/how-to-create-key-value-from-nested-fields/242084/8 "2020-07-21T19:51:03Z")
I have tested in my logstash configuration using ruby code what you suggested in link and it gives the output as
headers\_transformed.Ansible redirect
headers\_transformed.Department WebServices
headers\_transformed.Environment Production
headers\_transformed.Name PR-Redirect
headers\_transformed.aws:autoscaling:groupName PR-Redirect
But I want output as
`headers_transformed.tags : Ansible:redirect;Department:WebServices; etc.,`
Please help me out for creating the field.
---
### Author:  [@Jenni](https://discuss.elastic.co/u/Jenni)
#### Post date: [July 21, 2020, 8:24pm UTC](https://discuss.elastic.co/t/how-to-create-key-value-from-nested-fields/242084/9 "2020-07-21T20:24:52Z")
… which is why I had posted the second link. But I'll just try to type a clear solution on my phone: (This is bound to fail, but I hope you'll get the idea even if my code is buggy)
```auto
ruby {
code => '
tags = {}
event.get("[aws][datasource][resource][instancDetails][tags]").each do |item|
tags[item["key"]] = item["value"]
end
event.set("[aws][datasource][resource][instancDetails][tags]", tags.map{|k,v| "#{k}:#{v}"}.join(";"))
'
}
```
---
### Author:  [@Ramalakshmi](https://discuss.elastic.co/u/Ramalakshmi)
#### Post date: [July 22, 2020, 6:49pm UTC](https://discuss.elastic.co/t/how-to-create-key-value-from-nested-fields/242084/10 "2020-07-22T18:49:54Z")
The requirement changed. In message I am getting aws.datasource.resource..instancDetails.tags in this key value pairs are coming.
How can I add key value pairs to another field i.e, tags field for that how write ruby code for that. Already in tags field getting some data(tags=datasource).
Expected output is tags=guardduty;key1:value1;key2:value2 etc,
Please help me out this.
---
### Author:  [@Ramalakshmi](https://discuss.elastic.co/u/Ramalakshmi)
#### Post date: [July 23, 2020, 3:10pm UTC](https://discuss.elastic.co/t/how-to-create-key-value-from-nested-fields/242084/13 "2020-07-23T15:10:39Z")
While creating [aws][datasource][resource][instancDetails][tags]=key1:value1;key2:value2; etc., using below code
```
ruby {
code => '
tags = {}
event.get("[aws][datasource][resource][instancDetails][tags]").each do |item|
tags[item["key"]] = item["value"]
end
event.set("[aws][datasource][resource][instancDetails][tags]", tags.map{|k,v| "#{k}:#{v}"}.join(";"))
'
}
```
And I am getting error
Ruby exception occurred: undefined method `each' for nil:NilClass
Please suggest me how resolve this.
---
### Author:  [@Jenni](https://discuss.elastic.co/u/Jenni)
#### Post date: [July 23, 2020, 3:45pm UTC](https://discuss.elastic.co/t/how-to-create-key-value-from-nested-fields/242084/14 "2020-07-23T15:45:00Z")
Seems like `[aws][datasource][resource][instancDetails][tags]` doesn't exist, at least for some of your documents. Try to put a condition around the Ruby filter like `if [aws][datasource][resource][instancDetails][tags] { … }`.
But first make sure that you've got the correct field name because your initial post says that there is a field `[aws][datasource][resource][instancDetails][tags]`, but in your JSON I only see `[resource][instancDetails][tags]`. Or is that JSON only the content of`[aws][datasource]`? Then there might just be some events without any tags, but the general structure is correct.
---
### Author:  [@Ramalakshmi](https://discuss.elastic.co/u/Ramalakshmi)
#### Post date: [July 23, 2020, 6:52pm UTC](https://discuss.elastic.co/t/how-to-create-key-value-from-nested-fields/242084/15 "2020-07-23T18:52:30Z")
I have given wrong field name in code.Now I changed the field name and it's working fine.
Thank you so much.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 20, 2020, 6:52pm UTC](https://discuss.elastic.co/t/how-to-create-key-value-from-nested-fields/242084/16 "2020-08-20T18:52:31Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.