# Refer and extract unknown name attribute

**URL:** <https://discuss.elastic.co/t/refer-and-extract-unknown-name-attribute/231553>\
**Category:** Logstash\
**Created:** [May 7, 2020, 1:47pm UTC](https://discuss.elastic.co/t/refer-and-extract-unknown-name-attribute/231553 "2020-05-07T13:47:30Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![astrodi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/astrodi/32/117732_2.png) [@astrodi](https://discuss.elastic.co/u/astrodi)\
**Post date:** [May 7, 2020, 1:47pm UTC](https://discuss.elastic.co/t/refer-and-extract-unknown-name-attribute/231553/1 "2020-05-07T13:47:30Z")

</div>

Hi there,

I would like to extract the unknown (index) name from JSON in logstash.

Structure of input is:

```auto
     ...
     "indices": {
           "dna_master_v1": {
               ...
          }
     }

```

I want to extract "dna\_master\_v1", it is variable and I don't have exact index name (since calling the stats endopoint via alias, also user doesn't have rights to call \_cat/aliases)

I have tried this in filter:

```auto
     ...
     if [indices]: {
           mutate {
              add_field => {"index_name" => "%{[indices][0]}"}
          }
     }

```

and also couple of different forms like:

- "%{indices[0]}"
- "%{[indices]}"
- "%{[indices]\*}"
- "[indices][0]"
- etc

With all the options I was not able to get in index desired state:  
`"index_name": "dna_master_v1"`

all the time there is just a string for example:

`"index_name": "%{[indices][0]}"`

I was googling, but find nothing relevant to it (maybe it's because I'm quite a newbie in Logstash)  
Thank you for your help or any clue how to move forward  
Dominik

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 7, 2020, 3:47pm UTC](https://discuss.elastic.co/t/refer-and-extract-unknown-name-attribute/231553/2 "2020-05-07T15:47:53Z")

</div>

You are showing [indices] as a hash, not an array, so nothing like %{[indices][0]} will work. You might be able to do it with a ruby filter

```
ruby {
    code => '
        event.get("indices").each { |k, v|
            event.set("index_name", k)
        }
    '
}
```

---

<div class="post-metadata">

**Author:** ![astrodi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/astrodi/32/117732_2.png) [@astrodi](https://discuss.elastic.co/u/astrodi)\
**Post date:** [May 11, 2020, 8:31am UTC](https://discuss.elastic.co/t/refer-and-extract-unknown-name-attribute/231553/3 "2020-05-11T08:31:11Z")

</div>

thank you @Badger, this works well.  
I needed to put whole ruby inside "filter" element and under condition if [indices] { ... } to avoid "Ruby exception occurred: undefined method 'each' for nil:NilClass"

Thank you once again

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 8, 2020, 8:31am UTC](https://discuss.elastic.co/t/refer-and-extract-unknown-name-attribute/231553/4 "2020-06-08T08:31:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.