# How to find last element of array in logstash

**URL:** <https://discuss.elastic.co/t/how-to-find-last-element-of-array-in-logstash/243276>\
**Category:** Logstash\
**Created:** [July 30, 2020, 7:42pm UTC](https://discuss.elastic.co/t/how-to-find-last-element-of-array-in-logstash/243276 "2020-07-30T19:42:26Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Rakesh\_Katakam](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rakesh_katakam/32/47247_2.png) [@Rakesh\_Katakam](https://discuss.elastic.co/u/Rakesh_Katakam)\
**Post date:** [July 30, 2020, 7:42pm UTC](https://discuss.elastic.co/t/how-to-find-last-element-of-array-in-logstash/243276/1 "2020-07-30T19:42:26Z")

</div>

Hi, I am trying to split **string** and add a new event with last index as value.  
Here below is code snippet which I am trying.

Could someone please help me out on the same.  
Input : eqdomain/eqlogs/abc/hyper.log

Script:

```auto
input {
 stdin {}	
}
filter{
    grok{
        match => {"message" => "%{GREEDYDATA:originalMsg}"}
    }
	mutate {
		split => { "message" => "/" }
	}
	ruby {
		code => 'event.set("count",event.get("message").length)'
	}
	mutate {
		add_field => ["newMessage" , "%{[message]["count"]}" ]
	}		
}	
 output {
		stdout {}		
}

```

Here in add\_field I am trying to add a field with last element, this part I am not able to figure out.

Thanks,  
Rakesh

---

<div class="post-metadata">

**Author:** ![Jenni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jenni/32/29684_2.png) [@Jenni](https://discuss.elastic.co/u/Jenni)\
**Post date:** [July 30, 2020, 7:58pm UTC](https://discuss.elastic.co/t/how-to-find-last-element-of-array-in-logstash/243276/2 "2020-07-30T19:58:29Z")

</div>

Two things that stood out to me:

- You're trying to use `count` as the last array index, but it isn't. Array indices start at zero, so the last index is the array length minus one.
- You can't use the field in your `add_field` like this. This kind of syntax to use one field as the index to select something from another in those placeholders just doesn't exist in Logstash. You can only solve that with Ruby.

The following code should give you what you want:  
`event.set("newMessage", event.get("message")[-1])`

* * *

Edit: Just two more comments: If you don't need the rest of the array, you could forego the split filter and do it all with Ruby as `event.get("message").split('/')[-1]`. And what purpose does that grok filter have? It seems unnecessary?

---

<div class="post-metadata">

**Author:** ![Rakesh\_Katakam](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rakesh_katakam/32/47247_2.png) [@Rakesh\_Katakam](https://discuss.elastic.co/u/Rakesh_Katakam)\
**Post date:** [July 30, 2020, 8:28pm UTC](https://discuss.elastic.co/t/how-to-find-last-element-of-array-in-logstash/243276/3 "2020-07-30T20:28:58Z")

</div>

Yes Agreed, just trying out with GROK to map and add additional events.

And Thanks Jenni for quick reply and solution provided is working as expected.

As well could you please suggest why "\r" is getting appended to **newMessage** field value.

```auto
{
    "newMessage" => "abc.log\r",
          "host" => "723L",
      "@version" => "1",
    "@timestamp" => 2020-07-30T20:07:44.576Z,
       "message" => [
        [0] "D:",
        [1] "Oracle",
        [2] "Middleware",
        [3] "Oracle_Home",
        [4] "user_projects",
        [5] "domains",
        [6] "eqdomain",
        [7] "eqlogs",
        [8] "ssasti",
        [9] "abc.log\r"
    ]
}

```

---

<div class="post-metadata">

**Author:** ![Jenni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jenni/32/29684_2.png) [@Jenni](https://discuss.elastic.co/u/Jenni)\
**Post date:** [July 30, 2020, 8:38pm UTC](https://discuss.elastic.co/t/how-to-find-last-element-of-array-in-logstash/243276/4 "2020-07-30T20:38:51Z")

</div>

That seems to be the rest of a windows line break (CRLF: `\r\n`) . Your original message was split from the rest of a string at `\n` (Unix line break LF) and the Carriage Return `\r` stayed. I don't know why or where that happened. But you can probably get rid of it with mutate with the strip or gsub option.

---

<div class="post-metadata">

**Author:** ![Rakesh\_Katakam](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rakesh_katakam/32/47247_2.png) [@Rakesh\_Katakam](https://discuss.elastic.co/u/Rakesh_Katakam)\
**Post date:** [July 30, 2020, 8:44pm UTC](https://discuss.elastic.co/t/how-to-find-last-element-of-array-in-logstash/243276/5 "2020-07-30T20:44:10Z")

</div>

Okay @Jenni , I will give a try on the same.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 27, 2020, 8:44pm UTC](https://discuss.elastic.co/t/how-to-find-last-element-of-array-in-logstash/243276/6 "2020-08-27T20:44:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.