# Logstash: Замена индексов в массиве в JSON

**URL:** <https://discuss.elastic.co/t/logstash-json/200848>\
**Category:** Вопросы на русском языке\
**Created:** [September 24, 2019, 11:09am UTC](https://discuss.elastic.co/t/logstash-json/200848 "2019-09-24T11:09:32Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Igor\_Belyakov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/igor_belyakov/32/52615_2.png) [@Igor\_Belyakov](https://discuss.elastic.co/u/Igor_Belyakov)\
**Post date:** [September 24, 2019, 11:09am UTC](https://discuss.elastic.co/t/logstash-json/200848/1 "2019-09-24T11:09:33Z")

</div>

Добрый день. Я зашел в тупик.  
Как заменить все вхождения ID вот в таком JSON:  
"\_source": {  
"rules": [  
{  
"ruleid": "001"  
"action": "count"  
}  
{  
"ruleid": "003"  
"action": "count"  
}  
]  
}  
Замена значения одного конкретного поля работает корректно, но если поле содержит массив неясной размерности, то фильтр alter -\> condrewrite уже не работает.

---

<div class="post-metadata">

**Author:** ![Igor\_Motov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/igor_motov/32/45193_2.png) [@Igor\_Motov](https://discuss.elastic.co/u/Igor_Motov)\
**Post date:** [September 24, 2019, 1:28pm UTC](https://discuss.elastic.co/t/logstash-json/200848/2 "2019-09-24T13:28:58Z")

</div>

> [@Transform array objects in fields](https://discuss.elastic.co/t/transform-array-objects-in-fields/121269):
>
> hi, I have a object like this: "fields": [{ "value": "123", "id": "0" }, { "value": "456", "id": "1" }, { "value": "llllobj", "id": "2" }] but i want change the id to a field in my object like this: "fields": { "0": "123", "1": "456", "2": "llllobj" } it´s possible? What is the most appropriate filter for this?

---

<div class="post-metadata">

**Author:** ![Igor\_Belyakov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/igor_belyakov/32/52615_2.png) [@Igor\_Belyakov](https://discuss.elastic.co/u/Igor_Belyakov)\
**Post date:** [September 24, 2019, 3:09pm UTC](https://discuss.elastic.co/t/logstash-json/200848/3 "2019-09-24T15:09:06Z")

</div>

Это решение не подходит.  
В моем случае, значения, которые нужно подставить вместо индексов, хранятся в отдельном массиве.

---

<div class="post-metadata">

**Author:** ![Igor\_Motov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/igor_motov/32/45193_2.png) [@Igor\_Motov](https://discuss.elastic.co/u/Igor_Motov)\
**Post date:** [September 24, 2019, 3:22pm UTC](https://discuss.elastic.co/t/logstash-json/200848/4 "2019-09-24T15:22:41Z")

</div>

Это ruby - вы можете написать то решение, которое вам подходит.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 22, 2019, 3:22pm UTC](https://discuss.elastic.co/t/logstash-json/200848/5 "2019-10-22T15:22:45Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.