# Logstash unnest nested components using ruby

**URL:** <https://discuss.elastic.co/t/logstash-unnest-nested-components-using-ruby/356044>\
**Category:** Logstash\
**Created:** [March 24, 2024, 12:19am UTC](https://discuss.elastic.co/t/logstash-unnest-nested-components-using-ruby/356044 "2024-03-24T00:19:22Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![chowpay](https://avatars.discourse-cdn.com/v4/letter/c/ee7513/32.png) [@chowpay](https://discuss.elastic.co/u/chowpay)\
**Post date:** [March 24, 2024, 12:19am UTC](https://discuss.elastic.co/t/logstash-unnest-nested-components-using-ruby/356044/1 "2024-03-24T00:19:22Z")

</div>

I have fields that come into the system with nested components.  
Using this code in logstash:

```auto
    if [receivers] {
            split {
                field => "receivers"
            }

        }

        ruby {
            code => "
                event.get('receivers').each do |key, value|
                    if value.is_a?(Hash) || value.is_a?(Array)
                        event.set('receiver_'+key, value.to_json)
                    else
                        event.set('receiver_'+key, value)
                    end
                end
            "
        }

```

Seems to work to unnest the document AND create a new field. But does not work if the field has nested keys. For example here is part of the field that coming in from redis:

```auto
 "receivers": [
    {
      "stream_type": "HLS",
      "target_duration": 4.1,
      "selection": {
        "found": true,
        "resolution": "1280x720",
        "bandwidth": 6281474,
        "codecs": "mp4a.40.5,avc1.640020"
      },...
  ]

```

field and thus does not create a new field (see image below)

Am I missing something that will allow me to create a field like:  
`receiver_networks_source_ip : ipaddress`

I think the ruby code itself is sound because if I build an array outside of logstash I can loop through and map out keys with . in the name. So I'm guessing its a logstash thing?

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/c/ac35f514e99ea8c1d9a8715d5c4cd44282786802.png)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 21, 2024, 12:20am UTC](https://discuss.elastic.co/t/logstash-unnest-nested-components-using-ruby/356044/2 "2024-04-21T00:20:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.