# How to extract the data in the target to the root directory

**URL:** <https://discuss.elastic.co/t/how-to-extract-the-data-in-the-target-to-the-root-directory/148054>\
**Category:** Logstash\
**Created:** [September 11, 2018, 6:17am UTC](https://discuss.elastic.co/t/how-to-extract-the-data-in-the-target-to-the-root-directory/148054 "2018-09-11T06:17:00Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![sun\_changlong](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sun_changlong/32/39036_2.png) [@sun\_changlong](https://discuss.elastic.co/u/sun_changlong)\
**Post date:** [September 11, 2018, 6:17am UTC](https://discuss.elastic.co/t/how-to-extract-the-data-in-the-target-to-the-root-directory/148054/1 "2018-09-11T06:17:00Z")

</div>

After I use the kv plugin to parse the log, I want to filter the value further. I want to further process the value of cmd. Replace `\"` with `"`.how to use ruby filter to loop through k,v pairs?

I used the **target** in the kv plugin, using **ruby** to pick up the target for parsing and filtering, but the target changed the original field name.

my data look like below:

```
level="2" treatment="3" cmd1="\"D:\Program Files (x86)\a\safe\modules\setup.exe\" /s /smartsilence" type="sys"

```

the logstash config look like below:

```
kv {
  source => "message"
  field_split => "[,\s]"
  value_split => "="
  trim_key => "\s"
  trim_value => "\""
  target => "kv"
}
ruby {
  code => "
    event = event.get('kv')
    event.each { |key,value|
      if value.include? '\"' 
        event[key] = value.gsub!('\"', '')
      end
    }
  "
}

```

the result is :

```
kv {
  level="2"
  treatment="3"
  cmd="D:\Program Files (x86)\a\safe\modules\setup.exe /s /smartsilence"
  type="sys"
}

```

The original field name might be **cmd** , but it now becomes **kv.cmd.**  
What should I do if I don't use **target** as a connection? Or after using the target in ruby，how to extract the data in the target to the root directory?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 9, 2018, 6:17am UTC](https://discuss.elastic.co/t/how-to-extract-the-data-in-the-target-to-the-root-directory/148054/2 "2018-10-09T06:17:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.