# Logstash nested array parsing

**URL:** <https://discuss.elastic.co/t/logstash-nested-array-parsing/90009>\
**Category:** Logstash\
**Created:** [June 20, 2017, 12:49am UTC](https://discuss.elastic.co/t/logstash-nested-array-parsing/90009 "2017-06-20T00:49:24Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Shuxin\_Lin](https://avatars.discourse-cdn.com/v4/letter/s/da6949/32.png) [@Shuxin\_Lin](https://discuss.elastic.co/u/Shuxin_Lin)\
**Post date:** [June 20, 2017, 12:49am UTC](https://discuss.elastic.co/t/logstash-nested-array-parsing/90009/1 "2017-06-20T00:49:24Z")

</div>

Hi,

Right now I have an entry like this after applying kv filter:

```auto
"b/r/n": "1/1/0",

```

I would like this entry to be expanded as:

```auto
"b/r/n": { # the field name is not strictly to be "b/r/n"
    "b": 1, 
    "r": 1,
    "n": 0
}

```

Can somebody give me an idea if this is possible? I think this might be workable by `ruby` filter. But I am not sure.

---

<div class="post-metadata">

**Author:** ![jsvd](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsvd/32/6203_2.png) [@jsvd](https://discuss.elastic.co/u/jsvd)\
**Post date:** [June 20, 2017, 10:04am UTC](https://discuss.elastic.co/t/logstash-nested-array-parsing/90009/2 "2017-06-20T10:04:55Z")

</div>

ideally you want that `{ "b/r/n": "1/1/0" }` hash to be in a field with a known name, so you can then do:

```auto
input { stdin { codec => json } }
filter {
  ruby { code => 'old_hash = event.get("data");
                  new_hash = {};
                  old_hash.each do |k, v|
                    keys = k.split("/")
                    values = v.split("/")
                    new_hash[k] = Hash[keys.zip(values)]
                  end
                  event.set("data", new_hash)'
  }
}
output { stdout { codec => rubydebug } }

```

Then testing this results in:

```auto
/tmp/logstash-5.4.1 % echo '{"data": {"b/r/n": "1/2/3", "a/b/c": "9/8/7" }}' | bin/logstash -f ../cfg
{
    "@timestamp" => 2017-06-20T10:02:44.522Z,
          "data" => {
        "a/b/c" => {
            "a" => "9",
            "b" => "8",
            "c" => "7"
        },
        "b/r/n" => {
            "b" => "1",
            "r" => "2",
            "n" => "3"
        }
    },
      "@version" => "1",
          "host" => "Joaos-MBP-5"
}

```

Beware that this code doesn't deal with exception scenarios, like uneven number of elements (`"b/r": "1/1/0"`) or if some elements in the hash are not in this form (e.g. `{ "b/r/n": "1/1/0", "hey": "you"}`)

---

<div class="post-metadata">

**Author:** ![Shuxin\_Lin](https://avatars.discourse-cdn.com/v4/letter/s/da6949/32.png) [@Shuxin\_Lin](https://discuss.elastic.co/u/Shuxin_Lin)\
**Post date:** [June 20, 2017, 5:37pm UTC](https://discuss.elastic.co/t/logstash-nested-array-parsing/90009/3 "2017-06-20T17:37:01Z")

</div>

Wow. This is incredible. Thank you so much!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 18, 2017, 5:37pm UTC](https://discuss.elastic.co/t/logstash-nested-array-parsing/90009/4 "2017-07-18T17:37:01Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.