# Parse inner objects and assign all value to fields

**URL:** <https://discuss.elastic.co/t/parse-inner-objects-and-assign-all-value-to-fields/179272>\
**Category:** Logstash\
**Created:** [May 2, 2019, 1:47am UTC](https://discuss.elastic.co/t/parse-inner-objects-and-assign-all-value-to-fields/179272 "2019-05-02T01:47:08Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![yuva\_rajan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yuva_rajan/32/44683_2.png) [@yuva\_rajan](https://discuss.elastic.co/u/yuva_rajan)\
**Post date:** [May 2, 2019, 1:47am UTC](https://discuss.elastic.co/t/parse-inner-objects-and-assign-all-value-to-fields/179272/1 "2019-05-02T01:47:09Z")

</div>

Hi,

Below is my complete json events.

```
{
  "_index": "text_2019.05",
  "_type": "doc",
  "_id": "K7cldmoBJfAjCSoFDrmP",
  "_version": 1,
  "_score": null,
  "_size": 2494,
  "_source": {
    "@timestamp": "2019-05-02T01:25:01.138Z",
    "event_msg": "*** has detected a threat against your company.",
    "event_detailedMsg": "The application DropboxHelperInstaller has escalated privileges.",
    "event_email": "Email: itsupport",
    "event_severity": "Severity: Monitored",
    "event_url": " *****",
    "event_name": "Name: Sugis-MacBook.local",
    "event_threadscore": "Threat score: 4",
    "@version": "1",
    "event_incidentid": "Incident id: FYHGYDSF",
    "event_priority": "Monitored alert priority >=4",
    "event_ostype": "Type and OS: MAC MAC OS X 10.11.6",
    "event_policy": "Group: *****",
    "notification": {
      "threatInfo": {
        "indicators": [
          {
            "indicatorName": "PRIVILEGE_ESCALATE",
            "applicationName": "DropboxHelperInstaller",
            "sha256Hash": "cbc8f2c703e5c0103d9248ce7c8366ee277ef4a0a846b3d7c47e35c804a16b40"
          },
          {
            "indicatorName": "UNKNOWN_APP",
            "applicationName": "DropboxHelperInstaller",
            "sha256Hash": "cbc8f2c703e5c0103d9248ce7c8366ee277ef4a0a846b3d7c47e35c804a16b40"
          }
        ],
        "time": 1556760031555,
        "threatCause": {
          "reputation": "NOT_LISTED",
          "actorProcessPPid": "476-1556759512152-532",
          "originSourceType": "UNKNOWN",
          "causeEventId": "6fbfd9626c7811e9ae06cd4b551c81da",
          "threatCategory": "NEW_MALWARE",
          "reason": "R_ESCALATE",
          "actor": "cbc8f2c703e5c0103d9248ce7c8366ee277ef4a0a846b3d7c47e35c804a16b40",
          "actorName": "",
          "actorType": null
        },
        "score": 4,
        "summary": "The application DropboxHelperInstaller has escalated privileges.",
        "incidentId": "FYHGYDSF"
      },
      "type": "THREAT",
      "url": " ****",
      "eventDescription": "[Monitored alert priority >=4] [*****has detected a threat against your company.] [*****] [The application DropboxHelperInstaller has escalated privileges.] [Incident id: FYHGYDSF] [Threat score: 4] [Group: *****] [Email: itsupport] [Name: Sugis-MacBook.local] [Type and OS: MAC MAC OS X 10.11.6] [Severity: Monitored]\n",
      "eventTime": 1556759477805,
      "deviceInfo": {
        "deviceId": 1766584,
        "groupName": " *****",
        "deviceHostName": null,
        "externalIpAddress": " ****",
        "deviceName": " ******",
        "deviceType": "MAC",
        "internalIpAddress": " ****",
        "deviceVersion": "MAC OS X 10.11.6",
        "email": "itsupport",
        "targetPriorityType": "MEDIUM",
        "targetPriorityCode": 0
      },
      "ruleName": "Monitored alert priority >=4"
    }
  },
  "fields": {
    "@timestamp": [
      "2019-05-02T01:25:01.138Z"
    ]
  },
  "sort": [
    1556760301138
  ]
}

```

I want to read the inner objects of "notification.threatInfo.indicators.indicatorName" and store all the value of indicatorName in some field. that field value will looks like "newfield: ["value1", "value2", "value3"]

Can some one let me know, how to achieve this. thank you.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 2, 2019, 6:38pm UTC](https://discuss.elastic.co/t/parse-inner-objects-and-assign-all-value-to-fields/179272/2 "2019-05-02T18:38:50Z")

</div>

I would do that using

```
    ruby {
        code => '
            a = []
            event.get("[notification][threatInfo][indicators]").each { |v|
                a << v["indicatorName"]
            }
            event.set("newField", a)
        '
    }
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 30, 2019, 6:38pm UTC](https://discuss.elastic.co/t/parse-inner-objects-and-assign-all-value-to-fields/179272/3 "2019-05-30T18:38:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.