# How to get both key and value from JOSN uisng ruby

**URL:** https://discuss.elastic.co/t/how-to-get-both-key-and-value-from-josn-uisng-ruby/144470
**Category:** Logstash
**Created:** [August 15, 2018, 8:05am UTC](https://discuss.elastic.co/t/how-to-get-both-key-and-value-from-josn-uisng-ruby/144470 "2018-08-15T08:05:39Z")
**Posts on this page:** 8
**Page:** 1

<div class="post-metadata">

### Author: ![Charan\_Adabala](https://avatars.discourse-cdn.com/v4/letter/c/eb8c5e/32.png) [@Charan\_Adabala](https://discuss.elastic.co/u/Charan_Adabala)
#### Post date: [August 15, 2018, 8:05am UTC](https://discuss.elastic.co/t/how-to-get-both-key-and-value-from-josn-uisng-ruby/144470/1 "2018-08-15T08:05:39Z")

</div>

Hi,  
I want both key and value from json using ruby in logstash, By using the belwo snippet, able to get only value not key. i need key also. Can you please help me:

Event:  
{"result":{"entities":{"HOST-B765":"apple"}}}

Snippet:  
ruby {  
code =\> '  
hostId = ""  
serverName = ""  
event.get("[result][entities]").each { |x|  
x.each { |key, value|  
event.set("hostId", key)  
event.set("serverName", value)  
}  
}  
'  
}  
Output:  
{"hostId":"apple","serverName":null}

Desired Output:

{"hostId":"HOST-B765","serverName":"apple"}

Can any one please help me

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [August 15, 2018, 11:38am UTC](https://discuss.elastic.co/t/how-to-get-both-key-and-value-from-josn-uisng-ruby/144470/2 "2018-08-15T11:38:30Z")

</div>

```
        code => '
            event.get("[result][entities]").each { |k,v|
                event.set("hostId", k)
                event.set("serverName", v)
            }
        '
```

---

<div class="post-metadata">

### Author: ![Charan\_Adabala](https://avatars.discourse-cdn.com/v4/letter/c/eb8c5e/32.png) [@Charan\_Adabala](https://discuss.elastic.co/u/Charan_Adabala)
#### Post date: [August 15, 2018, 1:56pm UTC](https://discuss.elastic.co/t/how-to-get-both-key-and-value-from-josn-uisng-ruby/144470/3 "2018-08-15T13:56:00Z")

</div>

Thanks for replying,

I have one more question can you please help me:

Input:  
{"result":{"dataPoints":{"HOST-B89B05174C5B9765":[[1531504800000,84.54410552978516],[1531526400000,99.29006958007812]}}}

Desired Output:  
{"dataPointTime":"1531504800000","dataPointValue":"84.54410552978516"}  
{"dataPointTime":"1531526400000","dataPointValue":"99.29006958007812"}

Can you please help me how to solve

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [August 15, 2018, 1:57pm UTC](https://discuss.elastic.co/t/how-to-get-both-key-and-value-from-josn-uisng-ruby/144470/4 "2018-08-15T13:57:30Z")

</div>

Do you mean you want to [split](https://www.elastic.co/guide/en/logstash/current/plugins-filters-split.html) an event into two different events?

---

<div class="post-metadata">

### Author: ![Charan\_Adabala](https://avatars.discourse-cdn.com/v4/letter/c/eb8c5e/32.png) [@Charan\_Adabala](https://discuss.elastic.co/u/Charan_Adabala)
#### Post date: [August 15, 2018, 1:58pm UTC](https://discuss.elastic.co/t/how-to-get-both-key-and-value-from-josn-uisng-ruby/144470/5 "2018-08-15T13:58:14Z")

</div>

Yeah I tried with ruby code but only last index value I'm getting

Tried like this :

ruby {  
code =\> '  
dataPointTime = ""  
dataPointValue = ""  
dataPoints\_size = event.get("[result][dataPoints][HOST-B89B05174C5B9765]").size  
dataPoints\_size.times do |index|  
dataPointTime += event.get("[result][dataPoints][HOST-B89B05174C5B9765][#{index}][0]")+ ","  
dataPointValue += event.get("[result][dataPoints][HOST-B89B05174C5B9765][#{index}][1]")+ ","  
end  
event.set("dataPointTime", dataPointTime)  
event.set("dataPointValue", dataPointValue)  
'  
}

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [August 15, 2018, 2:05pm UTC](https://discuss.elastic.co/t/how-to-get-both-key-and-value-from-josn-uisng-ruby/144470/6 "2018-08-15T14:05:36Z")

</div>

You do not need to use ruby. You can use a mutate filter.

```
    split { field => "[result][dataPoints][HOST-B89B05174C5B9765]" }
    mutate { add_field => { "dataPointTime" => "%{[result][dataPoints][HOST-B89B05174C5B9765][0]}" } }
```

---

<div class="post-metadata">

### Author: ![Charan\_Adabala](https://avatars.discourse-cdn.com/v4/letter/c/eb8c5e/32.png) [@Charan\_Adabala](https://discuss.elastic.co/u/Charan_Adabala)
#### Post date: [August 15, 2018, 2:09pm UTC](https://discuss.elastic.co/t/how-to-get-both-key-and-value-from-josn-uisng-ruby/144470/7 "2018-08-15T14:09:03Z")

</div>

But I have around to 10 datapoints in the host, so I need to write dynamically. Can you please help me.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 12, 2018, 2:09pm UTC](https://discuss.elastic.co/t/how-to-get-both-key-and-value-from-josn-uisng-ruby/144470/8 "2018-09-12T14:09:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
