# Put array elements into new fields with logstash filter **URL:** \ **Category:** Logstash\ **Created:** [October 5, 2020, 11:01am UTC](https://discuss.elastic.co/t/put-array-elements-into-new-fields-with-logstash-filter/250980 "2020-10-05T11:01:22Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![LuigiDelavega](https://avatars.discourse-cdn.com/v4/letter/l/9de0a6/32.png) [@LuigiDelavega](https://discuss.elastic.co/u/LuigiDelavega)\ **Post date:** [October 5, 2020, 11:01am UTC](https://discuss.elastic.co/t/put-array-elements-into-new-fields-with-logstash-filter/250980/1 "2020-10-05T11:01:23Z")
Hello, I have an issue finding a solution for my problem : My filebeat sends IIS logs to logstash, with an URIPATH field named iis.uri, it looks like : `/aaaaa/bbbbb/cccccc/dddddd/eeeeee` I copy this field i wanna keep into a new field named iis.uriSplit in a mutate-copy then i use mutate-split to get an array from this field, so i got : `iis.uri : /aaaaa/bbbbb/cccccc/dddddd/eeeeee` `iis.uriSplit : (empty field here) , aaaaa , bbbbb , cccccc , dddddd , eeeeee` And now i woud like to get `iis.uriSplit.1 = aaaaa` , `iis.uriSplit.2 = bbbbb` etc.. to use them as alone fields for term aggregation in visualisations, and that's where is my problem. I tried to use ruby filter to do so : ```auto ruby { code => ' urisplit = event.get("[iis][uriSplit]") urisplit.each_with_index do |hash, index| event.set("iis.uri.#{index}", hash) end ' } OR code => ' event.get("[iis][uriSplit]").each_with_index do |hash, index| event.set("[iis][uri][#{index}]", hash) end ' ``` But it tells me i have an ERROR at ' event.get(" ' Do you have a better knowledge about ruby and could you share it with me ? Thanks for your time, Best regards, Louis Vince. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [October 5, 2020, 2:17pm UTC](https://discuss.elastic.co/t/put-array-elements-into-new-fields-with-logstash-filter/250980/2 "2020-10-05T14:17:16Z")
> [@LuigiDelavega](#): > > But it tells me i have an ERROR at ' event.get(" ' > Do you have a better knowledge about ruby and could you share it with me ? What exactly is the error? ---
**Author:** ![LuigiDelavega](https://avatars.discourse-cdn.com/v4/letter/l/9de0a6/32.png) [@LuigiDelavega](https://discuss.elastic.co/u/LuigiDelavega)\ **Post date:** [October 7, 2020, 8:00am UTC](https://discuss.elastic.co/t/put-array-elements-into-new-fields-with-logstash-filter/250980/3 "2020-10-07T08:00:42Z")
Hi again, Sorry i'm late to answer, i had to work on another subject. I had an error on event.get cause my split separator was "/" and not "\" so i was escaping ", my bad. So now i have my initial error : ```auto [2020-10-07T09:51:05,710][ERROR][logstash.filters.ruby][main][cfe6ecf8cf1e91b0b7f95d7bc492842543ce44907b4797946370e95ae0f1abe4] Ruby exception occurred: undefined method `each_with_index' for nil:NilClass ``` I would like to get 5 fields maximum from this iis.uriSplit array, but my iis.uri begin with a "/" so i get an empty field i would like to delete, so i tried to slice my array but same error, undefined method ... Last point, if my uri is only "/aaaaaa/bbbbbb" or "/aaaaaa/bbbbbb/cc/dd/ee/ff/gg" i would like to get 5 fields from a to e in each case. Can i put a simple condition on index or there will be a scope problem ? Thanks for your time, Louis Vince. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [October 7, 2020, 2:32pm UTC](https://discuss.elastic.co/t/put-array-elements-into-new-fields-with-logstash-filter/250980/4 "2020-10-07T14:32:46Z")
> [@LuigiDelavega](#): > > `undefined method `each\_with\_index' for nil:NilClass` If you are getting that error then event.get("[iis][uriSplit]") is returning nil, which means the field [iis][uriSplit] does not exists. Is it possible that the field has a period in the name and is actually called [iis.uriSplit]? ---
**Author:** ![LuigiDelavega](https://avatars.discourse-cdn.com/v4/letter/l/9de0a6/32.png) [@LuigiDelavega](https://discuss.elastic.co/u/LuigiDelavega)\ **Post date:** [October 8, 2020, 2:06pm UTC](https://discuss.elastic.co/t/put-array-elements-into-new-fields-with-logstash-filter/250980/5 "2020-10-08T14:06:56Z")
You were right, but now i got : ```auto [2020-10-08T15:47:30,275][WARN][logstash.outputs.elasticsearch][main][3c05c5b1356a71bcf7bbbc8e41ba3f0c15e3c3f02d261fb1bfef89ef0679ed77] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"filebeat-7.8.1-test-iis-2020.10.08", :routing=>nil, :_type=>"_doc"}, #], :response=>{"index"=>{"_index"=>"filebeat-7.8.1-test-iis-2020.10.08", "_type"=>"_doc", "_id"=>"tr93CHUB-QmTWdJue61y", "status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"mapper [iis.uri] of different type, current_type [text], merged_type [ObjectMapper]"}}}} ``` So i tried to had return [event] after my end but it doesn't change the warn. My index is empty. Then i change `event.set("[iis.uri.#{index}]", hash)` with the return [event] and get : ```auto [2020-10-08T16:00:33,913][WARN][logstash.outputs.elasticsearch][main][d1fe8cf683c32a081e7311b29bcfd01d3d7cb39f123ffea9648ea861c3635ecd] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"filebeat-7.8.1-test-iis-2020.10.08", :routing=>nil, :_type=>"_doc"}, #], :response=>{"index"=>{"_index"=>"filebeat-7.8.1-test-iis-2020.10.08", "_type"=>"_doc", "_id"=>"B7-DCHUB-QmTWdJucq-3", "status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"Can't merge a non object mapping [iis.uri] with an object mapping [iis.uri]"}}}} ``` So i tried to take off return [event] and i get : ```auto [2020-10-08T16:03:40,678][WARN][logstash.outputs.elasticsearch][main][d1fe8cf683c32a081e7311b29bcfd01d3d7cb39f123ffea9648ea861c3635ecd] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"filebeat-7.8.1-test-iis-2020.10.08", :routing=>nil, :_type=>"_doc"}, #], :response=>{"index"=>{"_index"=>"filebeat-7.8.1-test-iis-2020.10.08", "_type"=>"_doc", "_id"=>"VL-GCHUB-QmTWdJuTK8y", "status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"mapper [iis.uri] of different type, current_type [text], merged_type [ObjectMapper]"}}}} ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 5, 2020, 2:07pm UTC](https://discuss.elastic.co/t/put-array-elements-into-new-fields-with-logstash-filter/250980/6 "2020-11-05T14:07:04Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.