# Logstash-iterating through array field with specific action for every value

**URL:** <https://discuss.elastic.co/t/logstash-iterating-through-array-field-with-specific-action-for-every-value/269702>\
**Category:** Logstash\
**Created:** [April 9, 2021, 11:33am UTC](https://discuss.elastic.co/t/logstash-iterating-through-array-field-with-specific-action-for-every-value/269702 "2021-04-09T11:33:49Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jan\_Kabelka](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jan_kabelka/32/72840_2.png) [@Jan\_Kabelka](https://discuss.elastic.co/u/Jan_Kabelka)\
**Post date:** [April 9, 2021, 11:33am UTC](https://discuss.elastic.co/t/logstash-iterating-through-array-field-with-specific-action-for-every-value/269702/1 "2021-04-09T11:33:49Z")

</div>

Hi,logstash wizards! I suppose ruby must be used for what I need but I tried many many ways with no success:( I parse DNS responses on Logstash and as a result I have field below with array of values:

```auto
    {"dns": {
          "answers": {
            "data": [
              "apple.com.akadns.net",
              "17.57.146.53",
              "17.57.146.52",
              "17.57.146.68",
              "17.57.146.69"
            ]
    }

```

This field is-of course-data type of text. I would need to copy only IP addresses from this array (eg thanks to regex `\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}`) and save them to new array field with data type of IP. Result should look like:

```auto
{"dns": {
      "answers": {
        "data_ip": [
          "17.57.146.53",
          "17.57.146.52",
          "17.57.146.68",
          "17.57.146.69"
        ]
}

```

Then I would need to use geoip plugin and store ASN numbers, company name etc for every IP address from field [dns][answer][data\_ip] to new array field. Result should look like:

```auto
{"dns": {
      "answers": {
        "data_geo_asn": [
          "714",
          "714",
          "714",
          "714"
        ]
}

```

```auto
{"dns": {
      "answers": {
        "data_geo_company": [
          "Apple",
          "Apple",
          "Apple",
          "Apple"
        ]
}

```

Used geoip plugin should look similarly like:

```auto
    geoip {
      database => "/etc/logstash/conf.d/GeoIP2-ISP.mmdb"
      source => "[dns][answer][data_ip]"
      target => "[dns][answer][data_geo]"
      tag_on_failure => ["_geoip_asn_lookup_failure"]
      }

```

Really appreciate any help! Jan

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 9, 2021, 3:40pm UTC](https://discuss.elastic.co/t/logstash-iterating-through-array-field-with-specific-action-for-every-value/269702/2 "2021-04-09T15:40:00Z")

</div>

> [@Jan\_Kabelka](#):
>
> I would need to copy only IP addresses from this array (eg thanks to regex `\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}` ) and save them to new array field with data type of IP.

This part is fairly simple. Something like this (which I have not tested):

```
ruby {
    code => '
        data = event.get("[dns][answers][data]")
        if data
            event.set("[dns][answers][data_ip]", data.delete_if { |x| ! x.match(/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/) } )
        end
    '
}

```

However, if passed an array a geoip filter only parses the first entry. One possibility would be to split on the data\_ip array so that you have multiple events, call geoip, then aggregate them. Something similar to [this](https://discuss.elastic.co/t/a-json-array-consists-of-objects-how-to-deal-with/264464/2).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 7, 2021, 3:40pm UTC](https://discuss.elastic.co/t/logstash-iterating-through-array-field-with-specific-action-for-every-value/269702/3 "2021-05-07T15:40:52Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.