# How to loop through array in Logstash?

**URL:** <https://discuss.elastic.co/t/how-to-loop-through-array-in-logstash/291747>\
**Category:** Logstash\
**Created:** [December 14, 2021, 6:26am UTC](https://discuss.elastic.co/t/how-to-loop-through-array-in-logstash/291747 "2021-12-14T06:26:08Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![rijo\_joseph](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rijo_joseph/32/98881_2.png) [@rijo\_joseph](https://discuss.elastic.co/u/rijo_joseph)\
**Post date:** [December 14, 2021, 6:26am UTC](https://discuss.elastic.co/t/how-to-loop-through-array-in-logstash/291747/1 "2021-12-14T06:26:08Z")

</div>

```auto
{
  "modifiedTime": "2021-12-13T06:47:11.138Z",
  "task_owner_name": null,
  "contents": [
    {
      "eligible": false,
      "rawResponse": "454536251",
      "id": 868286622
    },
    {
      "eligible": false,
      "categoryScores": null,
      "analysisRequired": false,
      "questionId": 1000036797,
      "rawResponse": "454536251"
    },
    {
      "eligible": true,
      "categoryScores": null,
      "analysisRequired": true,
      "questionId": 1000036794,
      "rawResponse": "Us06OA26CyGf+TyFQU0t1lEjqs9OsOgBl0Uh1FcWg8lKODvn1573ODvleS9n9oU0mmcwd"
    }
  ],
  "author_post_flag": false
  }

```

I need to loop through "contents" array and need to perform decrypt the field "rawResponse" if "eligible" == "true"

currently Im doing like this

```auto
filter {
  if [contents][0][eligible]{
 cipher
{
 mode => decrypt
 algorithm => "AES-256-CBC"
 iv_random_length => 16
 key => " ***************"
 key_size => 32
 source => "[contents][0][rawResponse]"
 target => "[contents][0][rawResponse]"

}}}

```

It is working but I need to dynamically get the index value of the array , Currently it is hard coded, Can anyone please help

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [December 14, 2021, 6:34pm UTC](https://discuss.elastic.co/t/how-to-loop-through-array-in-logstash/291747/2 "2021-12-14T18:34:26Z")

</div>

> [@rijo\_joseph](#):
>
> I need to loop through "contents" array and need to perform decrypt the field "rawResponse" if "eligible" == "true"

One option would be to use a split filter to split that event into multiple events which each have a [contents] field which is a hash rather than an array. If you need to, you can then [recombine](https://discuss.elastic.co/t/a-json-array-consists-of-objects-how-to-deal-with/264464/2) them into a single event.

The other option is to iterate over the array in a ruby filter.

```
ruby {
    code => '
        c = event.get("contents")
        if c.is_a? Array
            c.each { |x|
            if x["eligible"]
                resp = x["rawResponse"]
                value = ...
                event.set("rawResponse", value)
            end
        end
    '
}

```

You would have to figure out what to replace the ... with by repurposing code from the [cipher](https://github.com/logstash-plugins/logstash-filter-cipher/blob/main/lib/logstash/filters/cipher.rb) filter.

---

<div class="post-metadata">

**Author:** ![rijo\_joseph](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rijo_joseph/32/98881_2.png) [@rijo\_joseph](https://discuss.elastic.co/u/rijo_joseph)\
**Post date:** [December 15, 2021, 5:37am UTC](https://discuss.elastic.co/t/how-to-loop-through-array-in-logstash/291747/3 "2021-12-15T05:37:19Z")

</div>

> [@Badger](#):
>
> `event.set("rawResponse", value)`

do we need to specify the index variable here ? like `event.set(x["rawResponse"],value`) like ?

when I use this it is replacing the globally defined rawResponse value not inside the array

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [December 15, 2021, 1:07pm UTC](https://discuss.elastic.co/t/how-to-loop-through-array-in-logstash/291747/4 "2021-12-15T13:07:14Z")

</div>

Indeed, that code will not work. Perhaps

```
ruby {
    code => '
        c = event.get("contents")
        if c.is_a? Array
            c.each_index { |x|
            if c[x]["eligible"]
                resp = c[x]["rawResponse"]
                value = ...
                event.set(c[x]["rawResponse"], value)
            end
        end
    '
}

```

although I have not tested that either.

---

<div class="post-metadata">

**Author:** ![rijo\_joseph](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rijo_joseph/32/98881_2.png) [@rijo\_joseph](https://discuss.elastic.co/u/rijo_joseph)\
**Post date:** [January 11, 2022, 9:15am UTC](https://discuss.elastic.co/t/how-to-loop-through-array-in-logstash/291747/5 "2022-01-11T09:15:10Z")

</div>

```auto
c = event.get("contents")
c.each_with_index do |value, index|
    if value["eligible"]
         resp = value["rawResponse"]
         value = 
         event.set("[contents][#{index}][rawResponse]",value)

```

above code is worked for me  
thanks @Badger

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 8, 2022, 9:15am UTC](https://discuss.elastic.co/t/how-to-loop-through-array-in-logstash/291747/6 "2022-02-08T09:15:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.