# Logstash-iterating through array field with specific action for every value

**URL:** <https://discuss.elastic.co/t/logstash-iterating-through-array-field-with-specific-action-for-every-value/269702>\
**Category:** Logstash\
**Created:** [April 9, 2021, 11:33am UTC](https://discuss.elastic.co/t/logstash-iterating-through-array-field-with-specific-action-for-every-value/269702 "2021-04-09T11:33:49Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 9, 2021, 3:40pm UTC](https://discuss.elastic.co/t/logstash-iterating-through-array-field-with-specific-action-for-every-value/269702/2 "2021-04-09T15:40:00Z")

</div>

> [@Jan\_Kabelka](#):
>
> I would need to copy only IP addresses from this array (eg thanks to regex `\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}` ) and save them to new array field with data type of IP.

This part is fairly simple. Something like this (which I have not tested):

```
ruby {
    code => '
        data = event.get("[dns][answers][data]")
        if data
            event.set("[dns][answers][data_ip]", data.delete_if { |x| ! x.match(/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/) } )
        end
    '
}

```

However, if passed an array a geoip filter only parses the first entry. One possibility would be to split on the data\_ip array so that you have multiple events, call geoip, then aggregate them. Something similar to [this](https://discuss.elastic.co/t/a-json-array-consists-of-objects-how-to-deal-with/264464/2).

---

_[View the full topic](https://discuss.elastic.co/t/logstash-iterating-through-array-field-with-specific-action-for-every-value/269702)._