### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [September 22, 2021, 1:08am UTC](https://discuss.elastic.co/t/how-to-read-each-array-item-into-a-map-of-key-value-pair/284769/4 "2021-09-22T01:08:22Z")
> [@Indigo\_Star](#):
>
> undefined method `scan' for #`
.scan is a method of the String class that repeatedly matches a regexp against that string. In your case [msg] is an array, so you need something more like
```
code => '
# Split multiline field into lines, removing newlines
m = event.get("msg").lines(chomp: true)
m.each { |x|
# See if there is a prefix
firstWord = x.match(/^([^]+) /)
if firstWord[1] =~ /=/
prefix = ""
else
prefix = "#{firstWord[1]}-"
end
matches = x.scan(/([a-zA-Z]+)=([^]+) /)
# matches is an array of arrays, one per match. For example
# [["CPU", "9%"], ["TotalMem", "12288"], ["FreeMem", "3895"]]
matches.each { |y|
event.set("#{prefix}#{y[0]}", y[1])
}
}
'
```
This will produce
```
"FreeMem" => "3895",
"TotalMem" => "12288",
"CPU" => "9%",
```
for the first line, and things like
```
"n2-yyyy-oo-size" => "11",
"n2-yyyy-oo-enqRate" => "3",
"n2-yyyy-oo-inFlight" => "4",
```
for the others. If you want
```
"n2-yyyy-oo" => {
"size" => "11",
"enqRate" => "3",
"inFlight" => "4"
},
```
you could rewrites the matches.each loop to do that.
If you want to include the " MB" in the memory numbers, so that you can use a bytes filter to convert them, then you would need to use a more complex regexp with a lookahead assertion.
---
### Author:  [@Indigo\_Star](https://discuss.elastic.co/u/Indigo_Star)
#### Post date: [September 23, 2021, 2:41am UTC](https://discuss.elastic.co/t/how-to-read-each-array-item-into-a-map-of-key-value-pair/284769/5 "2021-09-23T02:41:42Z")
Thanks @Badger it was a perfect solution .
---
### Author:  [@Indigo\_Star](https://discuss.elastic.co/u/Indigo_Star)
#### Post date: [September 23, 2021, 3:07am UTC](https://discuss.elastic.co/t/how-to-read-each-array-item-into-a-map-of-key-value-pair/284769/6 "2021-09-23T03:07:24Z")
One more thing @Badger is there a way to do the type conversion while setting field to the event.
e.g.
all the \*\*\*-size related fields i am getting the value as text whereas i need integer
can i do it in ruby while setting the field to event?
or is there a way to use mutate filter convert function to convert the fields by field-name pattern. because this list is dynamic.
e.g. is it possible
mutate {
convert =\> { "[._]-size" =\> "integer"}
convert =\> {"[._]-enqRate" =\> "integer"}
convert =\> { "[._]-deqRate" =\> "integer"}
convert =\> {"[._]-inFlight" =\> "integer"}
}
Thanks
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [September 23, 2021, 3:12am UTC](https://discuss.elastic.co/t/how-to-read-each-array-item-into-a-map-of-key-value-pair/284769/7 "2021-09-23T03:12:19Z")
You could try `event.set("#{prefix}#{y[0]}", y[1].to_i)` but I am not sure that works if y[1] is not just a number, so you might need something more like
```
if y[1] == y[1].to_i.to_s
event.set("#{prefix}#{y[0]}", y[1].to_i)
else
event.set("#{prefix}#{y[0]}", y[1])
end
```
---
### Author:  [@Indigo\_Star](https://discuss.elastic.co/u/Indigo_Star)
#### Post date: [September 23, 2021, 3:34am UTC](https://discuss.elastic.co/t/how-to-read-each-array-item-into-a-map-of-key-value-pair/284769/8 "2021-09-23T03:34:45Z")
yes i did try this,
event.set("#{prefix}#{y[0]}", y[1].to\_i(16))
before looking at your reply and it worked, i think yours is safer i will add it.
Thanks.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 21, 2021, 3:35am UTC](https://discuss.elastic.co/t/how-to-read-each-array-item-into-a-map-of-key-value-pair/284769/9 "2021-10-21T03:35:37Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.