# Need to parse field name via logstash
**URL:** https://discuss.elastic.co/t/need-to-parse-field-name-via-logstash/212186
**Category:** Logstash
**Created:** [December 17, 2019, 3:49pm UTC](https://discuss.elastic.co/t/need-to-parse-field-name-via-logstash/212186 "2019-12-17T15:49:22Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@shagun](https://discuss.elastic.co/u/shagun)
#### Post date: [December 17, 2019, 3:49pm UTC](https://discuss.elastic.co/t/need-to-parse-field-name-via-logstash/212186/1 "2019-12-17T15:49:22Z")
Hi,
I need to parse the field in the following input JSON via Logstash.
**INPUT**
```
{
"xyz": {
"http://com.myappliation.com/abc/def/fieldName": "value",
"id": "hsakjh-uuekjn-kj48ehu,
"http://com.myappliation.com/abc/defghii/fieldName2": "value",
"http://com.myappliation.com/abc/defhkjd/fieldName3": "value",
}
}
```
I need to parse the field name eg : `http://com.myappliation.com/abc/defghii/fieldName2` and rename it to `fieldName2`
The internal JSON xyz is dynamic so I need to Identify whenever the field like this "[http://abc/123/ssdf/](http://abc/123/ssdf/) **fieldName2**" will come I need to rename that field to the last dir name i.e **fieldName2** in this case.
**Expected Output :**
```
{
"xyz": {
"fieldName": "value",
"id": "hsakjh-uuekjn-kj48ehu",
"fieldName2": "value",
"fieldName3": "value"
}
}
```
I am trying but unable to find the solution till now, also tried to use ruby filter and grok.
Thanks in Advance 🙂
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [December 17, 2019, 10:17pm UTC](https://discuss.elastic.co/t/need-to-parse-field-name-via-logstash/212186/2 "2019-12-17T22:17:41Z")
I would do it in a ruby filter. I have not tested it, but something like
```
ruby {
code => '
xyz = event.get("xyz")
if xyz
newxyz = {}
xyz.each { |k, v|
newk = k.gsub(".*/", "")
newxyz[newk] = v
}
event.set("xyz", newxyz)
end
'
}
```
---
### Author:  [@shagun](https://discuss.elastic.co/u/shagun)
#### Post date: [December 18, 2019, 11:58am UTC](https://discuss.elastic.co/t/need-to-parse-field-name-via-logstash/212186/3 "2019-12-18T11:58:14Z")
Hi @Badger ,
I am using this now but that gsub is not working. It is giving me the same output as input. The regex is correct, but idk why the gsub function is not working here.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [December 18, 2019, 3:38pm UTC](https://discuss.elastic.co/t/need-to-parse-field-name-via-logstash/212186/4 "2019-12-18T15:38:49Z")
That's what you get for not testing before posting. Change the gsub line to
```
newk = k.gsub(/.*\//, "")
```
---
### Author:  [@shagun](https://discuss.elastic.co/u/shagun)
#### Post date: [December 19, 2019, 5:27am UTC](https://discuss.elastic.co/t/need-to-parse-field-name-via-logstash/212186/5 "2019-12-19T05:27:13Z")
Oh! I got it .
Thanks.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 16, 2020, 5:27am UTC](https://discuss.elastic.co/t/need-to-parse-field-name-via-logstash/212186/6 "2020-01-16T05:27:13Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.