# Parsing an array of KV pairs

**URL:** https://discuss.elastic.co/t/parsing-an-array-of-kv-pairs/165591
**Category:** Logstash
**Created:** [January 24, 2019, 12:01pm UTC](https://discuss.elastic.co/t/parsing-an-array-of-kv-pairs/165591 "2019-01-24T12:01:01Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Ash\_Powell](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ash_powell/32/40170_2.png) [@Ash\_Powell](https://discuss.elastic.co/u/Ash_Powell)
#### Post date: [January 24, 2019, 12:01pm UTC](https://discuss.elastic.co/t/parsing-an-array-of-kv-pairs/165591/1 "2019-01-24T12:01:02Z")

</div>

I am trying to parse some new data through Logstash, it comes through as an array of KV pairs  
"custom.fields": [  
{  
"Field\_A": "Value A"  
},  
{  
"Field\_B": "Value B"  
},  
{  
"Field\_C": "Value C"  
},  
{  
"Field\_D": "Value D"  
},  
{  
"Field\_E": "Value E"  
}  
]

I want to parse it within the same document so that when I index it to Elasticsearch it comes out as;  
"Field\_A": "Value A"  
"Field\_B": "Value B"

etc

We have been looking and I don't think any of the built in Plugins will cover this, and our attempts at Ruby haven't been working;  
event.get('[custom][fields]').each do |i|  
event.get(i).each {|k,v|  
event.set('[custom\_fields][' + k + ']', v)  
}  
end

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [January 24, 2019, 1:49pm UTC](https://discuss.elastic.co/t/parsing-an-array-of-kv-pairs/165591/2 "2019-01-24T13:49:04Z")

</div>

You are close...

```
        code => "
            event.get('[custom.fields]').each { |i|
                i.each {|k,v|
                    event.set('[custom_fields][' + k + ']', v)
                }
            }
        "

```

Do not use a dot in a field name. It works right up to the point where it stops working.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 21, 2019, 1:49pm UTC](https://discuss.elastic.co/t/parsing-an-array-of-kv-pairs/165591/3 "2019-02-21T13:49:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.