# Parsing a list of lists with logstash filter

**URL:** https://discuss.elastic.co/t/parsing-a-list-of-lists-with-logstash-filter/314747
**Category:** Logstash
**Created:** [September 20, 2022, 7:29am UTC](https://discuss.elastic.co/t/parsing-a-list-of-lists-with-logstash-filter/314747 "2022-09-20T07:29:24Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![amirfarsi](https://avatars.discourse-cdn.com/v4/letter/a/e95f7d/32.png) [@amirfarsi](https://discuss.elastic.co/u/amirfarsi)
#### Post date: [September 20, 2022, 7:29am UTC](https://discuss.elastic.co/t/parsing-a-list-of-lists-with-logstash-filter/314747/1 "2022-09-20T07:29:24Z")

</div>

Hello friends.

I have a list of lists in the form below:

doc 1:

`[[40004, 10], [40005, 12]]`

doc 2:

`[[40004, 8], [40006, 12], [20002, 3]]`

I want to change them to the following form:

doc 1:

```auto
{
    "40004": 10,
    "40005": 12
}

```

doc 2:

```auto
{
    "40004": 8,
    "40006": 12,
    "20002": 3
}

```

How can I do this with logstash filter ?

Thanks

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [September 20, 2022, 12:10pm UTC](https://discuss.elastic.co/t/parsing-a-list-of-lists-with-logstash-filter/314747/2 "2022-09-20T12:10:42Z")

</div>

You will need to use a ruby filter, something similar to [this](https://discuss.elastic.co/t/solved-split-filter-question-a-k-a-flatten-json-sub-array/130481/12).

---

<div class="post-metadata">

### Author: ![amirfarsi](https://avatars.discourse-cdn.com/v4/letter/a/e95f7d/32.png) [@amirfarsi](https://discuss.elastic.co/u/amirfarsi)
#### Post date: [September 24, 2022, 12:52pm UTC](https://discuss.elastic.co/t/parsing-a-list-of-lists-with-logstash-filter/314747/3 "2022-09-24T12:52:49Z")

</div>

I solved the problem in the following way:

```auto
mutate {

        gsub => [
            ## handeling multiple items
            "items", "\]\,", "-", ### [[40004, 10- [40005, 12]]
            
            ## removing extra characteres
            "items", "[\[\]]", "", ### 40004, 10- 40005, 12
            "items", "\s", "" ### 40004,10-40005,12
        ]
    }

kv {
    source => "items"
    field_split => "-"
    value_split => ","
    prefix => "item_"
}

```

Thanks @Badger

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 22, 2022, 12:53pm UTC](https://discuss.elastic.co/t/parsing-a-list-of-lists-with-logstash-filter/314747/4 "2022-10-22T12:53:37Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.