# Logstash: filter to convert string to array of values

**URL:** <https://discuss.elastic.co/t/logstash-filter-to-convert-string-to-array-of-values/103210>\
**Category:** Logstash\
**Created:** [October 9, 2017, 10:13am UTC](https://discuss.elastic.co/t/logstash-filter-to-convert-string-to-array-of-values/103210 "2017-10-09T10:13:36Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![geexee](https://avatars.discourse-cdn.com/v4/letter/g/d26b3c/32.png) [@geexee](https://discuss.elastic.co/u/geexee)\
**Post date:** [October 9, 2017, 10:13am UTC](https://discuss.elastic.co/t/logstash-filter-to-convert-string-to-array-of-values/103210/1 "2017-10-09T10:13:37Z")

</div>

Hello,

I have an input log string which contains some easy to regex-matching keywords. I want to index them as an array of values. E.g.

`"message"="User's locations: locERTY locRUIE locFGHD locTYUS"`

The below code successfully does what I want, in the `tag` field:

```
ruby {
    code => 'event.get("message").scan(/loc[A-Z]{4}/).each {|loc| event.tag(loc)}'
}

```

So, this outputs:

```
"tags": [
    "locERTY",
    "locRUIE",
    "locFGHD",
    "locTYUS"
]

```

Now, since I have several such lists, I want to use custom field names, instead of `tag`. The closest I got was this, which is not perfect because the result output is a key-value pair:

```
ruby {
    code => 'i=0; event.get("message").scan(/loc[A-Z]{4}/).each {|loc| event.set("[locs][#{i}]",loc); i+=1}'
}

```

This outputs:

```
"locs": [
    "0":"locERTY",
    "1":"locRUIE",
    "2":"locFGHD",
    "3":"locTYUS"
]

```

How can I output a custom `loc` field similar to the `tag` one above (with ruby or not)?

Thank you!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 6, 2017, 10:13am UTC](https://discuss.elastic.co/t/logstash-filter-to-convert-string-to-array-of-values/103210/2 "2017-11-06T10:13:55Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.