# Logstash 6.5.1 Ruby filter how to Modify nested json array

**URL:** https://discuss.elastic.co/t/logstash-6-5-1-ruby-filter-how-to-modify-nested-json-array/161389
**Category:** Logstash
**Created:** [December 18, 2018, 5:59pm UTC](https://discuss.elastic.co/t/logstash-6-5-1-ruby-filter-how-to-modify-nested-json-array/161389 "2018-12-18T17:59:12Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![alon.eldi](https://avatars.discourse-cdn.com/v4/letter/a/7ea924/32.png) [@alon.eldi](https://discuss.elastic.co/u/alon.eldi)
#### Post date: [December 18, 2018, 5:59pm UTC](https://discuss.elastic.co/t/logstash-6-5-1-ruby-filter-how-to-modify-nested-json-array/161389/1 "2018-12-18T17:59:12Z")

</div>

Hi ,

I have like following json  
{"id":"5",  
"name":"John Barns",  
"address":"Medison road",  
"Message":  
{"Header":  
{"Item":  
[{"Field\_Name":"Status",  
"Field\_Value":"Ok"},  
{"Field\_Name":"Type",  
"Field\_Value":"Short"}]  
}  
}  
}

I want to convert the array

[{"Field\_Name":"status",  
"Field\_Value":"Ok"},  
{"Field\_Name":"type",  
"Field\_Value":"Short"}]

to

[{"status":"OK"},  
{"type":"short]

Used the following script - but it does not work good

require "json"  
require "rubygems"  
def register(params)  
@json\_path\_to\_fix = params["json\_path\_to\_fix"]  
end

def filter(event)  
arr = {}  
field\_names = event.get("[Message][Header][Item][Field\_Name]")  
field\_values = event.get("[Message][Header][Item][Field\_Value]")  
print field\_names  
unless field\_names.nil?  
num\_of\_elements = field\_names.count  
for i in 0..num\_of\_elements-1 do  
arr[field\_names[i]]=field\_values[i]  
end  
event.set("[Message][Header][Item]",{arr})  
end  
return [event]  
end

Used the following doc  
[https://www.elastic.co/guide/en/logstash/current/event-api.html](https://www.elastic.co/guide/en/logstash/current/event-api.html)

Which does address nested arrays and how to access them .

Thanks a lot

Alon

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 15, 2019, 5:59pm UTC](https://discuss.elastic.co/t/logstash-6-5-1-ruby-filter-how-to-modify-nested-json-array/161389/2 "2019-01-15T17:59:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.