# Manipulating array of JSON objects

**URL:** <https://discuss.elastic.co/t/manipulating-array-of-json-objects/154192>\
**Category:** Logstash\
**Created:** [October 26, 2018, 11:53am UTC](https://discuss.elastic.co/t/manipulating-array-of-json-objects/154192 "2018-10-26T11:53:26Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![cappy](https://avatars.discourse-cdn.com/v4/letter/c/22d042/32.png) [@cappy](https://discuss.elastic.co/u/cappy)\
**Post date:** [October 26, 2018, 11:53am UTC](https://discuss.elastic.co/t/manipulating-array-of-json-objects/154192/1 "2018-10-26T11:53:26Z")

</div>

Hello,

I have an array of objects named `sections` like so:

```
{
  "structure": "IMAGE_SECTION_HEADER",
  "name": ".text",
  "flags": [
    "IMAGE_SCN_CNT_CODE",
    "IMAGE_SCN_MEM_EXECUTE",
    "IMAGE_SCN_MEM_READ"
  ]
},
{
  "structure": "IMAGE_SECTION_HEADER",
  "name": ".rdata",
  "flags": [
    "IMAGE_SCN_CNT_INITIALIZED_DATA",
    "IMAGE_SCN_MEM_READ"
  ]
},
{
  "structure": "IMAGE_SECTION_HEADER",
  "name": ".idata",
  "flags": [
    "IMAGE_SCN_CNT_INITIALIZED_DATA",
    "IMAGE_SCN_MEM_READ",
    "IMAGE_SCN_MEM_WRITE"
  ]
}

```

I would like to dynamically create fields like so (basically set the whole object for each `name` as the value for the newly created field):

```
sections.text : 

{
  "structure": "IMAGE_SECTION_HEADER",
  ".name": ".text",
  "flags": [
    "IMAGE_SCN_CNT_CODE",
    "IMAGE_SCN_MEM_EXECUTE",
    "IMAGE_SCN_MEM_READ"
  ]
}

```

The following Ruby code works fine for setting the field name, however, I am not able to populate the entire object into the value:

```
ruby {
  code => "event.get('sections').each {|hash| event.set('[new_sections][' + hash['name'].gsub('.', '') + ']', hash['value'])};" 
}

```

How would I access the current object that `event.get('sections').each` would be looking at to set that as the value for the hash in the `event.set` portion?

Any advice would be much appreciated. Thanks!

---

<div class="post-metadata">

**Author:** ![guyboertje](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/guyboertje/32/31592_2.png) [@guyboertje](https://discuss.elastic.co/u/guyboertje)\
**Post date:** [November 2, 2018, 4:39pm UTC](https://discuss.elastic.co/t/manipulating-array-of-json-objects/154192/2 "2018-11-02T16:39:39Z")

</div>

Try this:

```auto
input {
  generator {
    message => '{"sections":[
{
  "structure": "IMAGE_SECTION_HEADER", "name": ".text",
  "flags": ["IMAGE_SCN_CNT_CODE", "IMAGE_SCN_MEM_EXECUTE", "IMAGE_SCN_MEM_READ"]
},{
  "structure": "IMAGE_SECTION_HEADER", "name": ".rdata",
  "flags": ["IMAGE_SCN_CNT_INITIALIZED_DATA", "IMAGE_SCN_MEM_READ"]
},{
  "structure": "IMAGE_SECTION_HEADER",
  "name": ".idata",
  "flags": ["IMAGE_SCN_CNT_INITIALIZED_DATA", "IMAGE_SCN_MEM_READ", "IMAGE_SCN_MEM_WRITE"]
}]}'
    count => 1
  }
}

filter {
  json {
    source => "message"
    remove_field => ["message"]
  }
  ruby {
    code => '
hash = {}
event.get("sections").each do |section|
  # use fetch on the section hash so that gsub will always have a string to work with
  name_value = section.fetch("name", "no_name").gsub(/^\./, "")
  hash[name_value] = section
end
event.set("new_sections", hash)'
  }
}

output {
  stdout {
    codec => rubydebug
  }
}

```

Result:

```auto
{
        "@version" => "1",
        "sequence" => 0,
        "sections" => [
        [0] {
            "structure" => "IMAGE_SECTION_HEADER",
                 "name" => ".text",
                "flags" => [
                [0] "IMAGE_SCN_CNT_CODE",
                [1] "IMAGE_SCN_MEM_EXECUTE",
                [2] "IMAGE_SCN_MEM_READ"
            ]
        },
        [1] {
            "structure" => "IMAGE_SECTION_HEADER",
                 "name" => ".rdata",
                "flags" => [
                [0] "IMAGE_SCN_CNT_INITIALIZED_DATA",
                [1] "IMAGE_SCN_MEM_READ"
            ]
        },
        [2] {
            "structure" => "IMAGE_SECTION_HEADER",
                 "name" => ".idata",
                "flags" => [
                [0] "IMAGE_SCN_CNT_INITIALIZED_DATA",
                [1] "IMAGE_SCN_MEM_READ",
                [2] "IMAGE_SCN_MEM_WRITE"
            ]
        }
    ],
      "@timestamp" => 2018-11-02T16:24:39.731Z,
    "new_sections" => {
         "text" => {
            "structure" => "IMAGE_SECTION_HEADER",
                 "name" => ".text",
                "flags" => [
                [0] "IMAGE_SCN_CNT_CODE",
                [1] "IMAGE_SCN_MEM_EXECUTE",
                [2] "IMAGE_SCN_MEM_READ"
            ]
        },
        "rdata" => {
            "structure" => "IMAGE_SECTION_HEADER",
                 "name" => ".rdata",
                "flags" => [
                [0] "IMAGE_SCN_CNT_INITIALIZED_DATA",
                [1] "IMAGE_SCN_MEM_READ"
            ]
        },
        "idata" => {
            "structure" => "IMAGE_SECTION_HEADER",
                 "name" => ".idata",
                "flags" => [
                [0] "IMAGE_SCN_CNT_INITIALIZED_DATA",
                [1] "IMAGE_SCN_MEM_READ",
                [2] "IMAGE_SCN_MEM_WRITE"
            ]
        }
    },
            "host" => "Elastics-MacBook-Pro.local"
}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 30, 2018, 4:39pm UTC](https://discuss.elastic.co/t/manipulating-array-of-json-objects/154192/3 "2018-11-30T16:39:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.