# Is there a for loop to iterate from %{header1} to %{header40}

**URL:** <https://discuss.elastic.co/t/is-there-a-for-loop-to-iterate-from-header1-to-header40/185078>\
**Category:** Logstash\
**Created:** [June 11, 2019, 2:26am UTC](https://discuss.elastic.co/t/is-there-a-for-loop-to-iterate-from-header1-to-header40/185078 "2019-06-11T02:26:41Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![TsuWeiQuan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tsuweiquan/32/46252_2.png) [@TsuWeiQuan](https://discuss.elastic.co/u/TsuWeiQuan)\
**Post date:** [June 11, 2019, 2:26am UTC](https://discuss.elastic.co/t/is-there-a-for-loop-to-iterate-from-header1-to-header40/185078/1 "2019-06-11T02:26:41Z")

</div>

Hello,

I was wondering if there exists a more elegant way to do this.  
Currently, in my pipeline to process .log files, I used grok filter to filter field header and field data.  
This allows me to achieve 40 fields & 40 fields data.

To properly display it on kibana, i did this:

```
if [header40] =~ /.+/ {
	mutate {
      add_field => { "%{header1}" => "%{header1_data}" }
      remove_field => ["header1", "header1_data"]
      ....... (repeats for 40 times)
      .......
      add_field => { "%{header40}" => "%{header40_data}" }
      remove_field => ["header40", "header40_data"]
      }
 }

```

Is there a way to iterate this using a for loop so that it can be short & concise?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 11, 2019, 9:34am UTC](https://discuss.elastic.co/t/is-there-a-for-loop-to-iterate-from-header1-to-header40/185078/2 "2019-06-11T09:34:31Z")

</div>

```
    ruby {
        code => '
            for i in 1..40
                k = "header#{i}"
                s = event.get("#{k}_data")
                if s
                    event.set(k, s)
                    event.remove("#{k}_data")
                end
            end
        '
    }

```

It is ugly, but it works.

---

<div class="post-metadata">

**Author:** ![TsuWeiQuan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tsuweiquan/32/46252_2.png) [@TsuWeiQuan](https://discuss.elastic.co/u/TsuWeiQuan)\
**Post date:** [June 11, 2019, 9:59am UTC](https://discuss.elastic.co/t/is-there-a-for-loop-to-iterate-from-header1-to-header40/185078/3 "2019-06-11T09:59:12Z")

</div>

Thank you! It works but the header field remains as header\_(n)  
I refine the code alittle and this was the outcome:

```
 ruby {
      code => '
        for i in 1..40
          k = "header#{i}"
          s = event.get("#{k}_data")
          j = event.get("#{k}")
          if s
            event.set(j, s)
          else
            event.set(j, "")
          end
          event.remove("#{k}_data")
          event.remove("#{k}")
        end
      '
  }

```

Nevertheless, thank you for this. It helped

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 9, 2019, 9:59am UTC](https://discuss.elastic.co/t/is-there-a-for-loop-to-iterate-from-header1-to-header40/185078/4 "2019-07-09T09:59:18Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.