# Losgtash Ruby split nested fields as new field

**URL:** <https://discuss.elastic.co/t/losgtash-ruby-split-nested-fields-as-new-field/302539>\
**Category:** Logstash\
**Tags:** elastic-stack-monitoring, jdbc\
**Created:** [April 16, 2022, 8:02am UTC](https://discuss.elastic.co/t/losgtash-ruby-split-nested-fields-as-new-field/302539 "2022-04-16T08:02:19Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Akshay\_Kulkarni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/akshay_kulkarni/32/101037_2.png) [@Akshay\_Kulkarni](https://discuss.elastic.co/u/Akshay_Kulkarni)\
**Post date:** [April 16, 2022, 8:02am UTC](https://discuss.elastic.co/t/losgtash-ruby-split-nested-fields-as-new-field/302539/1 "2022-04-16T08:02:19Z")

</div>

Hi,  
I have below type of events.

![image](https://us1.discourse-cdn.com/elastic/original/3X/9/1/914646681866359bacff172ca2e8a583431e628f.png)

I m looking to split nested field (group\_kpi\_value) and trying to store in new field.  
kpi\_name=E & kpi\_value=511871 per chunk.

Im able to split single event in to multiple events with new filed "Kpi\_name and Kpi\_Value" but their(Kpi\_name and Kpi\_Value) values are NIL.

![image](https://us1.discourse-cdn.com/elastic/original/3X/b/1/b1d44002a1fe0089e0be807ebb53195ca9b62ac9.png)

Below is the Ruby Code.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/9/a90cbd63048df428b3b948009897a094754f2121.png)

![image](https://us1.discourse-cdn.com/elastic/original/3X/3/e/3e1d7beb63b4a9aa8df7a0475dd72f5e43f75e13.png)

Please suggest where im missing.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 16, 2022, 2:04pm UTC](https://discuss.elastic.co/t/losgtash-ruby-split-nested-fields-as-new-field/302539/2 "2022-04-16T14:04:24Z")

</div>

You could try

```
ruby {
    code => '
        values = > event.get("group_kpi_value")
        if values.is_a? Hash
            someField = []
            values.each { |k, v|
                someField << { "kpi_name" => k, "kpi_value" => v }
            }
            event.set("someField", someField)
        end
    '
}
split { field => "someField" }
```

---

<div class="post-metadata">

**Author:** ![Akshay\_Kulkarni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/akshay_kulkarni/32/101037_2.png) [@Akshay\_Kulkarni](https://discuss.elastic.co/u/Akshay_Kulkarni)\
**Post date:** [April 16, 2022, 2:35pm UTC](https://discuss.elastic.co/t/losgtash-ruby-split-nested-fields-as-new-field/302539/3 "2022-04-16T14:35:25Z")

</div>

Thanks a lot man @Badger 🙂

Just one change made to bring nested fields of "someField" to root

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/1/f/1f046570f7d6ae1bcacd9421cd672499023df5d1.png)

Have added "rename" as mentioned below.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/1/8/188b6e72c43f15c32be6524a5ad268f1e2684a67.png)

![image](https://us1.discourse-cdn.com/elastic/original/3X/0/a/0a61c44849b67a4a4e4640090b7aa2968d761cd5.png)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 14, 2022, 2:36pm UTC](https://discuss.elastic.co/t/losgtash-ruby-split-nested-fields-as-new-field/302539/4 "2022-05-14T14:36:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.