# Message to List then to Object representation

**URL:** https://discuss.elastic.co/t/message-to-list-then-to-object-representation/98527
**Category:** Logstash
**Created:** [August 28, 2017, 9:32am UTC](https://discuss.elastic.co/t/message-to-list-then-to-object-representation/98527 "2017-08-28T09:32:47Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![panchicore](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/panchicore/32/20150_2.png) [@panchicore](https://discuss.elastic.co/u/panchicore)
#### Post date: [August 28, 2017, 9:32am UTC](https://discuss.elastic.co/t/message-to-list-then-to-object-representation/98527/1 "2017-08-28T09:32:47Z")

</div>

I groked an event resulting with the field:

```
"a5" => "...",
"a6" => "KILL#11##1#Cameroon#CM#CM#6#12#CM;CRISISLEX_T03_DEAD#11##1#Cameroon#CM#CM#6#12#CM;"
"a7" => "...",

```

Then applied the split mutation to a6 and result was

```
"a6" => [
    [0] "KILL#11##1#Cameroon#CM#CM#6#12#CM",
    [1] "CRISISLEX_T03_DEAD#11##1#Cameroon#CM#CM#6#12#CM",
    [2] "KIDNAP#8##1#Cameroon#CM#CM#6#12#CM",
]

```

Now I want to split by # each a6 item and create an object like this:

```
"a6" => [
    [0] "Type => KILL, Count => 11, Test => "", B => 1 C=> Cameroon, D=> CM, E=> CM, F => 6, G => 12 H => CM",
    [1] "object repr",
    [2] "object repr",
]

```

I had tried splitting again but it result a list with all [0], other with all [1].. etc, also with KV with default keys but it seems not to work with lists.

Any ideas?

thanks!

---

<div class="post-metadata">

### Author: ![panchicore](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/panchicore/32/20150_2.png) [@panchicore](https://discuss.elastic.co/u/panchicore)
#### Post date: [August 28, 2017, 10:56am UTC](https://discuss.elastic.co/t/message-to-list-then-to-object-representation/98527/2 "2017-08-28T10:56:15Z")

</div>

Ruby filter worked

```
ruby {
  code => "
    r = []
    event.get('a6').each { |values|
        data = values.split('#')
        item = {
            'type' => data[0],
            'count' => data[1],
        }
        r << item
    }
    event.set('a6_objects', r)
  "
}

```

Any other recomendation?

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 25, 2017, 10:56am UTC](https://discuss.elastic.co/t/message-to-list-then-to-object-representation/98527/3 "2017-09-25T10:56:19Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.