# Parsing Logstash Data
**URL:** https://discuss.elastic.co/t/parsing-logstash-data/98685
**Category:** Logstash
**Created:** [August 29, 2017, 12:30pm UTC](https://discuss.elastic.co/t/parsing-logstash-data/98685 "2017-08-29T12:30:34Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@paul1243](https://discuss.elastic.co/u/paul1243)
#### Post date: [August 29, 2017, 12:30pm UTC](https://discuss.elastic.co/t/parsing-logstash-data/98685/1 "2017-08-29T12:30:35Z")
Hi -
I have the below message coming to the ELK, and I'd like to parse those values and create a mapping (Key =\> Value) and add as separate field in Elastic Search.
Please let me know how could I do this.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 29, 2017, 1:41pm UTC](https://discuss.elastic.co/t/parsing-logstash-data/98685/2 "2017-08-29T13:41:42Z")
You'll have to use a ruby filter that loops over the items in the `[json][Terminal]` field and adds the new fields. Something like this should work:
```nohighlight
event.get('[json][Terminal]').each { |h|
event.set(h['Name'], h['Value'])
}
```
---
### Author:  [@paul1243](https://discuss.elastic.co/u/paul1243)
#### Post date: [August 30, 2017, 11:40am UTC](https://discuss.elastic.co/t/parsing-logstash-data/98685/3 "2017-08-30T11:40:02Z")
Thanks @magnusbaeck.
That worked, Things I wanted to know:
How do I change the data type of the fields getting created. We'd expect this to be Integer.
And I've a field 
I'd need to split the values with the (Colan(';')) separated and push it to 4 different fields.
I've a ruby script created:
filter {
ruby {
code =\> "
data = event.get('CpuLoad').split(';')
data.each\_index {|i| event[i.to\_s]=times[i]
if times[i] == '4'
event['IndexValue'] = event['id'].index(4)}
end
"
}
}
It would be really a great help if you could help me out on this. Thanks !
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 30, 2017, 11:46am UTC](https://discuss.elastic.co/t/parsing-logstash-data/98685/4 "2017-08-30T11:46:06Z")
See [https://code-maven.com/convert-string-to-number-in-ruby](https://code-maven.com/convert-string-to-number-in-ruby). Keep in mind that if the destination field exists in ES as a string field you'll have to reindex the current index or create a new index to actually map the field as an integer.
---
### Author:  [@paul1243](https://discuss.elastic.co/u/paul1243)
#### Post date: [August 30, 2017, 11:49am UTC](https://discuss.elastic.co/t/parsing-logstash-data/98685/5 "2017-08-30T11:49:12Z")
Thanks so much for your quick reply @magnusbaeck.
Could you please help me out with the other question:
And I’ve a field 
I’d need to split the values with the (Colan(’;’)) separated and push it to 4 different fields.
I’ve a ruby script created but it doesn't seems to be alright: Could you please have a look:
filter {
ruby {
code =\> “
data = event.get(‘CpuLoad’).split(’;’)
data.each\_index {|i| event[i.to\_s]=times[i]
if times[i] == '4’
event[‘IndexValue’] = event[‘id’].index(4)}
end
”
}
}
Thank in advance.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 30, 2017, 11:51am UTC](https://discuss.elastic.co/t/parsing-logstash-data/98685/6 "2017-08-30T11:51:55Z")
Except that I don't know what `times` comes from the script looks more or less correct. Replace `times[i]` with `data[i]`?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 27, 2017, 11:52am UTC](https://discuss.elastic.co/t/parsing-logstash-data/98685/7 "2017-09-27T11:52:01Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.