# Modify values in json array with Ruby

**URL:** <https://discuss.elastic.co/t/modify-values-in-json-array-with-ruby/306756>\
**Category:** Logstash\
**Created:** [June 9, 2022, 4:19am UTC](https://discuss.elastic.co/t/modify-values-in-json-array-with-ruby/306756 "2022-06-09T04:19:08Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Long\_Nguyen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/long_nguyen/32/87276_2.png) [@Long\_Nguyen](https://discuss.elastic.co/u/Long_Nguyen)\
**Post date:** [June 9, 2022, 4:19am UTC](https://discuss.elastic.co/t/modify-values-in-json-array-with-ruby/306756/1 "2022-06-09T04:19:08Z")

</div>

Hello everyone,

I have a json structure as follows:

```auto
{
   "server":[
      {
         "active":true,
         "objID":1
      },
	  {
         "active":true,
         "objID":2
      },
	  {
         "active":false,
         "objID":3
      }
   ]
}

```

The json structure shows an array of servers and their objID. I would like to create a Ruby filter so that whenever the **active** field is false, the **objID** field will be set to an empty string. Below is my Ruby filter however it doesn't work since I am not familiar with Ruby....

```auto
a = event.get('[server]')
a.each_index { |i|
if a[i]["active"] == "false"
event.set(a[i]["objID"], "")
end
}

```

Any help would be appreciated! Thank you in advance.

---

<div class="post-metadata">

**Author:** ![Tomo\_M](https://avatars.discourse-cdn.com/v4/letter/t/848f3c/32.png) [@Tomo\_M](https://discuss.elastic.co/u/Tomo_M)\
**Post date:** [June 9, 2022, 10:24am UTC](https://discuss.elastic.co/t/modify-values-in-json-array-with-ruby/306756/2 "2022-06-09T10:24:31Z")

</div>

`a[i]["objID"]` in `event.set(a[i]["objID"], "")` may be solved to `3`.

Try:

```auto
event.set('[server][' + i.to_s + ']["objID"]', "")

```

---

<div class="post-metadata">

**Author:** ![Long\_Nguyen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/long_nguyen/32/87276_2.png) [@Long\_Nguyen](https://discuss.elastic.co/u/Long_Nguyen)\
**Post date:** [June 9, 2022, 12:31pm UTC](https://discuss.elastic.co/t/modify-values-in-json-array-with-ruby/306756/3 "2022-06-09T12:31:09Z")

</div>

Thank you for the answer, however when I tried your solution, I still got the syntax error as below:

```auto
Ruby {\r\n\t\t code => \"\r\n\t\t a = event.get('[server]')\r\n a.each_index { |i|\r\n if a[i][\"", backtrace=>["/appl/monitoring/ELK_V7.12.1/logstash-7.12.1/logstash-core/lib/logstash/compiler.rb:32:in `compile_imperative'", "org/logstash/execution/AbstractPipelineExt.java:184:in `initialize'", "org/logstash/execution/JavaBasePipelineExt.java:69:in `initialize'", "/appl/monitoring/ELK_V7.12.1/logstash-7.12.1/logstash-core/lib/logstash/java_pipeline.rb:47:in `initialize'", "/appl/monitoring/ELK_V7.12.1/logstash-7.12.1/logstash-core/lib/logstash/pipeline_action/create.rb:52:in `execute'", "/appl/monitoring/ELK_V7.12.1/logstash-7.12.1/logstash-core/lib/logstash/agent.rb:389:in `block in converge_state'"]}
[2022-06-09T14:24:57,521][INFO][logstash.runner] Logstash shut down.
[2022-06-09T14:24:57,536][FATAL][org.logstash.Logstash] Logstash stopped processing because of an error: (SystemExit) exit
org.jruby.exceptions.SystemExit: (SystemExit) exit
        at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:747) ~[jruby-complete-9.2.13.0.jar:?]
        at org.jruby.RubyKernel.exit(org/jruby/RubyKernel.java:710) ~[jruby-complete-9.2.13.0.jar:?]
        at appl.monitoring.ELK_V7_dot_12_dot_1.logstash_minus_7_dot_12_dot_1.lib.bootstrap.environment.<main>(/appl/monitoring/ELK_V7.12.1/logstash-7.12.1/lib/bootstrap/environment.rb:89) ~[?:?]

```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 9, 2022, 4:32pm UTC](https://discuss.elastic.co/t/modify-values-in-json-array-with-ruby/306756/4 "2022-06-09T16:32:39Z")

</div>

> [@Long\_Nguyen](#):
>
> `if a[i]["active"] == "false"`

The left hand side should be a boolean, not a string, so remove the quotes from the right hand side.

---

<div class="post-metadata">

**Author:** ![Long\_Nguyen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/long_nguyen/32/87276_2.png) [@Long\_Nguyen](https://discuss.elastic.co/u/Long_Nguyen)\
**Post date:** [June 9, 2022, 6:42pm UTC](https://discuss.elastic.co/t/modify-values-in-json-array-with-ruby/306756/5 "2022-06-09T18:42:30Z")

</div>

Thanks everyone! It works now!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 7, 2022, 6:43pm UTC](https://discuss.elastic.co/t/modify-values-in-json-array-with-ruby/306756/6 "2022-07-07T18:43:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.