# Losgtash Ruby extract JSON Array Key Value
**URL:** https://discuss.elastic.co/t/losgtash-ruby-extract-json-array-key-value/240909
**Category:** Logstash
**Created:** [July 13, 2020, 7:21am UTC](https://discuss.elastic.co/t/losgtash-ruby-extract-json-array-key-value/240909 "2020-07-13T07:21:46Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@lueneburger](https://discuss.elastic.co/u/lueneburger)
#### Post date: [July 13, 2020, 7:21am UTC](https://discuss.elastic.co/t/losgtash-ruby-extract-json-array-key-value/240909/1 "2020-07-13T07:21:47Z")
Hi Everyone,
i was looking last week for 2 days for this and i found a solution to my first use case, but i can't get it working for my second one 😕 also its the first time doing something with ruby, so maybe i missing something
its about the AWS SES log events for bounced emails, here is the snipped:
```auto
"bounce": {
"timestamp": "2020-07-09T10:06:09.000Z",
"bouncedRecipients": [
{
"action": "failed",
"diagnosticCode": "smtp;550 5.1.10 RESOLVER.ADR.RecipientNotFound; Recipient test@test.com not found by SMTP address lookup",
"status": "5.1.10",
"emailAddress": "test@test.com"
}
]
}
```
so i want to get all 4 fields and move it to bounce instead of bounce.bouncedRecipients
my filter right now is not working, i was thinking that i can just output the key + value of each entry of the array, but i only getting "key" and no "value" from this filter:
```auto
ruby {
code => "event.get('[bounce][bouncedRecipients]').each {|hash| event.set('[bounce][' + hash[key] + ']', hash[value]) }"
}
```
i was also trying to get a hash.each but...ahm yea, maybe i was reading and talking to much about ruby and can't see the obvious solution 😕
Thanks in advance for reading and hopefully also helping 🙂
Cheers
---
### Author:  [@Jenni](https://discuss.elastic.co/u/Jenni)
#### Post date: [July 13, 2020, 8:55am UTC](https://discuss.elastic.co/t/losgtash-ruby-extract-json-array-key-value/240909/2 "2020-07-13T08:55:10Z")
The problem with your code is that it assumes that your entries in `[bounce][bouncedRecipients]` are structured like `{ "key": "action", "value" : "failed"}`. But they aren't. They are just string values in a Hash.
```auto
ruby {
code => "
event.get('[bounce][bouncedRecipients]').each { |key, value|
event.set('[bounce][' + key + ']', value)
}
event.remove('[bounce][bouncedRecipients]')
"
}
```
---
### Author:  [@lueneburger](https://discuss.elastic.co/u/lueneburger)
#### Post date: [July 13, 2020, 10:58am UTC](https://discuss.elastic.co/t/losgtash-ruby-extract-json-array-key-value/240909/3 "2020-07-13T10:58:24Z")
Hi Jenni,
thanks for the help, now i getting a error in the logstash logs
```auto
Ruby exception occurred: no implicit conversion of Hash into String
```
already lookinf for it, but maybe you or someelse is faster 🙂
thanks in advance
---
### Author:  [@Jenni](https://discuss.elastic.co/u/Jenni)
#### Post date: [July 13, 2020, 11:01am UTC](https://discuss.elastic.co/t/losgtash-ruby-extract-json-array-key-value/240909/4 "2020-07-13T11:01:17Z")
Sorry. I didn't see that `bouncedRecipients` is not a Hash, but an array with one entry. Your fields are in `[bounce][bouncedRecipients][0]`.
---
### Author:  [@lueneburger](https://discuss.elastic.co/u/lueneburger)
#### Post date: [July 13, 2020, 11:06am UTC](https://discuss.elastic.co/t/losgtash-ruby-extract-json-array-key-value/240909/5 "2020-07-13T11:06:13Z")
awesome, it's working.
Thank you Jenni 🙂
cheers
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 10, 2020, 11:06am UTC](https://discuss.elastic.co/t/losgtash-ruby-extract-json-array-key-value/240909/6 "2020-08-10T11:06:18Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.