# Regarding Mutate Ruby filter

**URL:** https://discuss.elastic.co/t/regarding-mutate-ruby-filter/308426
**Category:** Logstash
**Created:** [June 29, 2022, 7:16am UTC](https://discuss.elastic.co/t/regarding-mutate-ruby-filter/308426 "2022-06-29T07:16:48Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![suresh\_u](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/suresh_u/32/107394_2.png) [@suresh\_u](https://discuss.elastic.co/u/suresh_u)
#### Post date: [June 29, 2022, 7:16am UTC](https://discuss.elastic.co/t/regarding-mutate-ruby-filter/308426/1 "2022-06-29T07:16:48Z")

</div>

I have 1 sample transaction number 10004567-P658910-569876.

I want to seperate above transaction number with index 0 as 1 seperate field and remaining as other field.

Ex: 10004567-P658910-569876  
Num\_field = 10004567  
Remaining\_field = P658910-569876

I tried using mutate split method. I am unable to loop over array.  
Below is the snippet I have tried:

**mutate {**  
**split =\> { "doc\_number" =\> "-" }**  
**ruby {**  
\*\* code =\> '\*\*  
\*\* ids = event.get("doc\_number")\*\*  
\*\* ids.each\_with\_index do |value, index|\*\*  
\*\* if index[0]\*\*  
\*\* event.set("[doc\_number]",value)\*\*  
\*\* end \*\*  
\*\* end\*\*  
\*\* '\*\*  
\*\* }\*\*  
**}**

Could you please @magnusbaeck help me out?

Thanks.

---

<div class="post-metadata">

### Author: ![preetish\_P](https://avatars.discourse-cdn.com/v4/letter/p/77aa72/32.png) [@preetish\_P](https://discuss.elastic.co/u/preetish_P)
#### Post date: [June 29, 2022, 9:25am UTC](https://discuss.elastic.co/t/regarding-mutate-ruby-filter/308426/2 "2022-06-29T09:25:20Z")

</div>

Hi @suresh_u ,

I would use the below approach for this:

```auto
grok { match => ["doc_number","%{GREEDYDATA:field1}-%{GREEDYDATA:temp_field1}-%{GREEDYDATA:temp_field2}"] 
add_field => { "field2" => "%{temp_field1}%{temp_field2}" }}   

```

---

<div class="post-metadata">

### Author: ![suresh\_u](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/suresh_u/32/107394_2.png) [@suresh\_u](https://discuss.elastic.co/u/suresh_u)
#### Post date: [June 29, 2022, 9:49am UTC](https://discuss.elastic.co/t/regarding-mutate-ruby-filter/308426/3 "2022-06-29T09:49:43Z")

</div>

thanks @preetish_P I will try

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 27, 2022, 9:50am UTC](https://discuss.elastic.co/t/regarding-mutate-ruby-filter/308426/4 "2022-07-27T09:50:37Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.