# Logstash array length check
**URL:** https://discuss.elastic.co/t/logstash-array-length-check/39681
**Category:** Logstash
**Created:** [January 20, 2016, 4:44pm UTC](https://discuss.elastic.co/t/logstash-array-length-check/39681 "2016-01-20T16:44:47Z")
**Posts on this page:** 16
**Page:** 1
### Author:  [@bubu.senapati](https://discuss.elastic.co/u/bubu.senapati)
#### Post date: [January 20, 2016, 4:44pm UTC](https://discuss.elastic.co/t/logstash-array-length-check/39681/1 "2016-01-20T16:44:48Z")
Hi ,
How can i check the length of an array in logstash.
I have a request that is request=/acoounts/debenhams/summary.
I had split it by "/".
I have to check the request.length i.e. the array size of the splitted array request.
I need to basically check if request[].length==4.
What is the syntax to do it.
regards
Dibyananda
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [January 20, 2016, 6:42pm UTC](https://discuss.elastic.co/t/logstash-array-length-check/39681/2 "2016-01-20T18:42:51Z")
You'll have to use a ruby filter.
```auto
ruby {
code => "event['length'] = event['request'].length"
}
```
---
### Author:  [@manthan\_patel](https://discuss.elastic.co/u/manthan_patel)
#### Post date: [April 14, 2017, 12:22pm UTC](https://discuss.elastic.co/t/logstash-array-length-check/39681/3 "2017-04-14T12:22:36Z")
Hi I m trying to get lenght of event but not able to do so can u help me correcting below config..
filter {
ruby{
code =\> "if event.length \> 5 then
event['new\_msg']= 'test\_message'
end
"
}
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [April 18, 2017, 5:08am UTC](https://discuss.elastic.co/t/logstash-array-length-check/39681/4 "2017-04-18T05:08:15Z")
`event.length` won't work. You have to indicate which field you're interested in, e.g. with `event.get('name-of-field').length`. To set the value of a field with Logstash 2.4 or later, see [https://www.elastic.co/guide/en/logstash/current/event-api.html](https://www.elastic.co/guide/en/logstash/current/event-api.html).
---
### Author:  [@manthan\_patel](https://discuss.elastic.co/u/manthan_patel)
#### Post date: [April 18, 2017, 6:14am UTC](https://discuss.elastic.co/t/logstash-array-length-check/39681/5 "2017-04-18T06:14:15Z")
Hi,
I want to get count of Event object. or either convert event object to array will also help me..
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [April 18, 2017, 6:27am UTC](https://discuss.elastic.co/t/logstash-array-length-check/39681/6 "2017-04-18T06:27:26Z")
What does "count of Event object" mean? The number of fields in the event?
---
### Author:  [@manthan\_patel](https://discuss.elastic.co/u/manthan_patel)
#### Post date: [April 18, 2017, 9:32am UTC](https://discuss.elastic.co/t/logstash-array-length-check/39681/7 "2017-04-18T09:32:17Z")
Yes exactly.. I want to get number of fields in event. As incoming events does not have fixed number of fields and i want to restrict number of fields.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [April 18, 2017, 11:14am UTC](https://discuss.elastic.co/t/logstash-array-length-check/39681/8 "2017-04-18T11:14:16Z")
In that case `event.to_hash.length` should work.
---
### Author:  [@manthan\_patel](https://discuss.elastic.co/u/manthan_patel)
#### Post date: [April 18, 2017, 11:37am UTC](https://discuss.elastic.co/t/logstash-array-length-check/39681/9 "2017-04-18T11:37:50Z")
NOT helping below is my passed json from UDP and I am also attaching output from logstash
input :-
{
"timestamp":"2017-04-18 17:04:30",
"message":"My logger is now ready",
"messageLevel":"FATAL",
"component":6,
"transactionId":0,
"test":"message",
"test1":"message",
"test2":"message",
"test3":"message",
"test4":"message",
"test5":"message",
"test6":"message",
"test7":"message",
"test8":"message",
"test9":"message",
"test10":"message",
"test11":"message",
"test12":"message",
"test13":"message",
"test14":"message",
"test15":"message",
"test16":"message",
"test17":"message",
"test18":"message",
"test19":"message",
"test20":"message",
"test21":"message",
"test22":"message",
"test23":"message",
"test24":"message",
"test25":"message",
"test26":"message"
}
output json shown in kibana :-
{
"\_index": "logstash-6-2017.04.18",
"\_type": "udplogs",
"\_id": "AVuA15Tl\_55gfmV0iY7d",
"\_score": null,
"\_source": {
"message": "My logger is now ready",
"@version": "1",
"@timestamp": "2017-04-18T11:34:23.250Z",
"host": "10.10.3.44",
"port": 39516,
"type": "udplogs",
"count": 6,
"timestamp": "2017-04-18 17:04:22",
"messageLevel": "FATAL",
"component": "Back1-Others",
"transactionId": 0,
"test": "message",
"test1": "message",
"test2": "message",
"test3": "message",
"test4": "message",
"test5": "message",
"test6": "message",
"test7": "message",
"test8": "message",
"test9": "message",
"test10": "message",
"test11": "message",
"test12": "message",
"test13": "message",
"test14": "message",
"test15": "message",
"test16": "message",
"test17": "message",
"test18": "message",
"test19": "message",
"test20": "message",
"test21": "message",
"test22": "message",
"test23": "message",
"test24": "message",
"test25": "message",
"test26": "message",
"componentId": 6
},
"fields": {
"@timestamp": [
1492515263250
]
},
"sort": [
1492515263250
]
}
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [April 18, 2017, 12:26pm UTC](https://discuss.elastic.co/t/logstash-array-length-check/39681/10 "2017-04-18T12:26:28Z")
And what does your ruby filter look like?
---
### Author:  [@manthan\_patel](https://discuss.elastic.co/u/manthan_patel)
#### Post date: [April 18, 2017, 1:09pm UTC](https://discuss.elastic.co/t/logstash-array-length-check/39681/11 "2017-04-18T13:09:07Z")
ruby {
code =\> "
event['count'] = event.to\_hash.length
"
}
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [April 18, 2017, 1:20pm UTC](https://discuss.elastic.co/t/logstash-array-length-check/39681/12 "2017-04-18T13:20:11Z")
I can't reproduce:
```nohighlight
$ cat input.json
{ "timestamp":"2017-04-18 17:04:30", "message":"My logger is now ready", "messageLevel":"FATAL", "component":6, "transactionId":0, "test":"message", "test1":"message", "test2":"message", "test3":"message", "test4":"message", "test5":"message", "test6":"message", "test7":"message", "test8":"message", "test9":"message", "test10":"message", "test11":"message", "test12":"message", "test13":"message", "test14":"message", "test15":"message", "test16":"message", "test17":"message", "test18":"message", "test19":"message", "test20":"message", "test21":"message", "test22":"message", "test23":"message", "test24":"message", "test25":"message", "test26":"message" }
$ cat test.config
input { stdin { codec => json_lines } }
output { stdout { codec => rubydebug } }
filter {
ruby {
code => "
event['count'] = event.to_hash.length
"
}
}
$ /opt/logstash/bin/logstash -f test.config < input.json
Settings: Default pipeline workers: 8
Pipeline main started
{
"timestamp" => "2017-04-18 17:04:30",
"message" => "My logger is now ready",
"messageLevel" => "FATAL",
"component" => 6,
"transactionId" => 0,
"test" => "message",
"test1" => "message",
"test2" => "message",
"test3" => "message",
"test4" => "message",
"test5" => "message",
"test6" => "message",
"test7" => "message",
"test8" => "message",
"test9" => "message",
"test10" => "message",
"test11" => "message",
"test12" => "message",
"test13" => "message",
"test14" => "message",
"test15" => "message",
"test16" => "message",
"test17" => "message",
"test18" => "message",
"test19" => "message",
"test20" => "message",
"test21" => "message",
"test22" => "message",
"test23" => "message",
"test24" => "message",
"test25" => "message",
"test26" => "message",
"@version" => "1",
"@timestamp" => "2017-04-18T13:19:47.223Z",
"host" => "lnxolofon",
"count" => 35
}
Pipeline main has been shutdown
stopping pipeline {:id=>"main"}
```
---
### Author:  [@manthan\_patel](https://discuss.elastic.co/u/manthan_patel)
#### Post date: [May 3, 2017, 10:15am UTC](https://discuss.elastic.co/t/logstash-array-length-check/39681/13 "2017-05-03T10:15:48Z")
Below is my logstash config.
input {
tcp {
'host' =\> '10.10.3.44'
'port' =\> '9564'
'type' =\> 'udplogs'
}
}
filter {
ruby {
# Cancel 90% of events
code =\> "
event['count'] = event.to\_hash.length
"
}
if [type] == "udplogs" {
json {
source =\> 'message'
}
mutate {
add\_field =\> {
"componentId" =\> "%{component}"
}
}
}
}
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [May 3, 2017, 10:20am UTC](https://discuss.elastic.co/t/logstash-array-length-check/39681/14 "2017-05-03T10:20:30Z")
And where are you doing anything with the `count` field? Your comment says "Cancel 90% of events" but there's no cancelling taking place anywhere.
---
### Author:  [@manthan\_patel](https://discuss.elastic.co/u/manthan_patel)
#### Post date: [May 3, 2017, 10:22am UTC](https://discuss.elastic.co/t/logstash-array-length-check/39681/15 "2017-05-03T10:22:55Z")
Yes i want to cancel events which had field count with more then 20 but in first i am not able to get count of event .
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:26am UTC](https://discuss.elastic.co/t/logstash-array-length-check/39681/16 "2017-07-06T04:26:50Z")