# JSON array parsing in Logstash using the ruby filter

**URL:** <https://discuss.elastic.co/t/json-array-parsing-in-logstash-using-the-ruby-filter/146829>\
**Category:** Logstash\
**Created:** [August 31, 2018, 8:11am UTC](https://discuss.elastic.co/t/json-array-parsing-in-logstash-using-the-ruby-filter/146829 "2018-08-31T08:11:45Z")\
**Posts on this page:** 1\
**Showing post:** 5

<div class="post-metadata">

**Author:** ![NerdSec](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nerdsec/32/22056_2.png) [@NerdSec](https://discuss.elastic.co/u/NerdSec)\
**Post date:** [September 3, 2018, 10:39am UTC](https://discuss.elastic.co/t/json-array-parsing-in-logstash-using-the-ruby-filter/146829/5 "2018-09-03T10:39:43Z")

</div>

This is getting parsed properly according to Logstash, but it is getting indexed as a nested object in Elasticsearch. As they are not well supported in Kibana, I hope to create a flat structured array using the ruby filter. Here is my config:

```auto
input {
  file {
    path => "/home/fire.log"
    sincedb_path => "/dev/null"
    start_position => "beginning"
    codec => json
  }
}
filter {
  ruby {
    code => "
      message_array = event.get('[alert][explanation][cnc-services][cnc-service]')
      if message_array.each_with_index { |item, index| event.set('cnc-service'+index.to_s, item) }
      end
    "
  }
  mutate {
    remove_field => ["[alert][explanation][os-changes]", "headers", "[alert][interface]", "alert", "appliance", "path", "product"]
  }
}
output {
  stdout { codec => rubydebug }
}

```

This gives me distinct `cnc-service` fields like [`cnc-service1`, `cnc-service2`, and so on] with a valid json object. I can definitely parse them using a json filter, but the number of `cnc-service` objects would vary and i do not wish to hard code it. Can I create a single hash object by merging them?

I am not familiar with ruby, in python I can easily do this as follows:

```auto
for k, v in chain(dict1.items(), dict2.items()):
    dict3[k].append(v)

```

Can I do something similar using the ruby filter?

---

_[View the full topic](https://discuss.elastic.co/t/json-array-parsing-in-logstash-using-the-ruby-filter/146829)._