# Not able to loop and read key value pairs in logstash

**URL:** <https://discuss.elastic.co/t/not-able-to-loop-and-read-key-value-pairs-in-logstash/144338>\
**Category:** Logstash\
**Created:** [August 14, 2018, 11:21am UTC](https://discuss.elastic.co/t/not-able-to-loop-and-read-key-value-pairs-in-logstash/144338 "2018-08-14T11:21:32Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sahaya\_Agnel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sahaya_agnel/32/69705_2.png) [@Sahaya\_Agnel](https://discuss.elastic.co/u/Sahaya_Agnel)\
**Post date:** [August 14, 2018, 11:21am UTC](https://discuss.elastic.co/t/not-able-to-loop-and-read-key-value-pairs-in-logstash/144338/1 "2018-08-14T11:21:32Z")

</div>

Hi,

Below is the JSON content that i want to process and read all the 'amount' and sum those values based on the business logic in the Logstash config file. Can you please help ?

"ClientSalaryData": {  
"person\_salary\_info": [  
{  
"client\_age": "56",  
"amount": "9999.00"  
},  
{  
"client\_age": "56",  
"amount": "450000.00"  
}  
]  
},

Logstash Config File:

```
xml {
  source => "spouse_salary_parent"
      target => "SpouseSalaryData"
  store_xml => true
  force_array => false
  xpath => [
	"/spouse_salary_info/amount/text()","personamount"
	]

```

}

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 14, 2018, 12:08pm UTC](https://discuss.elastic.co/t/not-able-to-loop-and-read-key-value-pairs-in-logstash/144338/2 "2018-08-14T12:08:01Z")

</div>

The relationship between the JSON data and the XML filter is unclear. But if you want to iterate over each entry in an array and sum the amount fields then a ruby filter could do that.

---

<div class="post-metadata">

**Author:** ![Sahaya\_Agnel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sahaya_agnel/32/69705_2.png) [@Sahaya\_Agnel](https://discuss.elastic.co/u/Sahaya_Agnel)\
**Post date:** [August 14, 2018, 1:07pm UTC](https://discuss.elastic.co/t/not-able-to-loop-and-read-key-value-pairs-in-logstash/144338/3 "2018-08-14T13:07:12Z")

</div>

> [@Sahaya\_Agnel](#):
>
> ClientSalaryData

Thank yo so much for you prompt response. Actually the above JSOn content is the output of XML filter. As i am new to ELK stack, can you please help me how to iterate and sum up the amount value in this structure ?

I am facing issues in getting the values from parent element 'ClientSalaryData'. Please help

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 14, 2018, 1:21pm UTC](https://discuss.elastic.co/t/not-able-to-loop-and-read-key-value-pairs-in-logstash/144338/4 "2018-08-14T13:21:23Z")

</div>

Something like this. Error handling left as an exercise for the reader.

```
ruby {
    code => '
        sum = 0
        event.get("[ClientSalaryData][person_salary_info]").each { |h|
            sum += h["amount"].to_f
        }
        event.set("sumOfAmount", sum)
    '
}
```

---

<div class="post-metadata">

**Author:** ![Sahaya\_Agnel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sahaya_agnel/32/69705_2.png) [@Sahaya\_Agnel](https://discuss.elastic.co/u/Sahaya_Agnel)\
**Post date:** [August 19, 2018, 4:22pm UTC](https://discuss.elastic.co/t/not-able-to-loop-and-read-key-value-pairs-in-logstash/144338/5 "2018-08-19T16:22:10Z")

</div>

Thanks a lot badger for your help in completing this.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 16, 2018, 4:22pm UTC](https://discuss.elastic.co/t/not-able-to-loop-and-read-key-value-pairs-in-logstash/144338/6 "2018-09-16T16:22:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.