# I would like to access nested data from an array

**URL:** <https://discuss.elastic.co/t/i-would-like-to-access-nested-data-from-an-array/71432>\
**Category:** Logstash\
**Created:** [January 12, 2017, 8:45pm UTC](https://discuss.elastic.co/t/i-would-like-to-access-nested-data-from-an-array/71432 "2017-01-12T20:45:50Z")\
**Posts on this page:** 1\
**Showing post:** 6

<div class="post-metadata">

**Author:** ![jsvd](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsvd/32/6203_2.png) [@jsvd](https://discuss.elastic.co/u/jsvd)\
**Post date:** [January 17, 2017, 1:29pm UTC](https://discuss.elastic.co/t/i-would-like-to-access-nested-data-from-an-array/71432/6 "2017-01-17T13:29:06Z")

</div>

I think the major issue here is that the source application is sending essentially a hash in array form.  
If the counters element was:

```auto
"counters": {
  "n_lost_packets": 0,
  "n_sent_bytes": 130852808
}

```

instead of:

```auto
"counters": [
  {
    "name": "n_lost_packets",
    "value": 0
  },
  {
    "name": "n_sent_bytes",
    "value": 130852808
  }
]

```

it would be simpler. If you want to programatically you need ruby filter since, in your case each hash contains a key under "key" and a value under "value", but it could be something else, also there can be duplicates, some elements may only contain key or value (errors happen), etc

in your case, to iterate over counters and set each property on event, you can do:

```auto
filter { ruby { code => "event.get('counters').each {|hash| event.set(hash['key'] = hash['value']) }" } }

```

(this code wasn't tested)

---

_[View the full topic](https://discuss.elastic.co/t/i-would-like-to-access-nested-data-from-an-array/71432)._