# Rename recursively field names in nested structure without changing the structure
**URL:** https://discuss.elastic.co/t/rename-recursively-field-names-in-nested-structure-without-changing-the-structure/290209
**Category:** Logstash
**Created:** [November 25, 2021, 6:55pm UTC](https://discuss.elastic.co/t/rename-recursively-field-names-in-nested-structure-without-changing-the-structure/290209 "2021-11-25T18:55:51Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@Isotta\_Blue](https://discuss.elastic.co/u/Isotta_Blue)
#### Post date: [November 25, 2021, 6:55pm UTC](https://discuss.elastic.co/t/rename-recursively-field-names-in-nested-structure-without-changing-the-structure/290209/1 "2021-11-25T18:55:51Z")
Hello, I have an event which is nested like this:
```auto
{
"test1": null,
"test2": null,
"test3": {
"test31": null,
"test32": null,
},
"test4":{
"test5": [
{
"test6": null,
"test7": null
} ]
}
```
etc
and I would like to find null values in it recursively and rename the fields that have those null values. So far I have done something like this in logstash config, it only handles hashes (haven't found how to handle arrays this way)
```auto
def first_meth(e)
hash_event = e.to_hash
new_meth(hash_event, e)
end
def new_meth(hash, ev)
hash.each do |key,value|
if value == nil
ev.set("[#{key}_null]", value)
ev.remove("[#{key}]")
end
if value.kind_of?(Hash)
f = ev.get("[#{key}]")
new_meth(f, ev)
end
end
end
```
somewhere else in the ruby code I call
```auto
first_meth(event)
```
the thing is it puts everything in root level. I don't want to change the structure. How could I do this?
```auto
{
"test1_null": null,
"test2_null": null,
"test3": {
"test31_null": null,
"test32_null": null,
},
"test4":{
"test5": [
{
"test6_null": null,
"test7_null": null
} ]
}
```
Thank you
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [November 25, 2021, 9:20pm UTC](https://discuss.elastic.co/t/rename-recursively-field-names-in-nested-structure-without-changing-the-structure/290209/2 "2021-11-25T21:20:42Z")
Not in the mood to write code on Thanksgiving, but take a look at [this](https://discuss.elastic.co/t/how-to-exclude-xml-json-key-value-if-key-length-is-greater-than-15-char-and-value-length-is-greater-than-100-char/270248/8) function. It recursively works its way through an event, including hashes and arrays, and keeps track of what the thing it is working on is called, which would allow you do something like
```
event.set("#{name}_null", event.remove(name))
```
---
### Author:  [@Isotta\_Blue](https://discuss.elastic.co/u/Isotta_Blue)
#### Post date: [November 26, 2021, 1:03pm UTC](https://discuss.elastic.co/t/rename-recursively-field-names-in-nested-structure-without-changing-the-structure/290209/3 "2021-11-26T13:03:26Z")
Hello, thanks for the reply. I changed my code and did
```auto
def first_meth(e)
hash_event = e.to_hash
hash event.each { |k,v|
new_meth(v, k, e)
}
end
def new_meth(object, name, ev)
if value == nil
ev.set("#{name}_null", value)
ev.remove(name)
end
if value.kind_of?(Hash)
f = ev.get("#{name}")
f.each { |k,v|
nm = "#{name}[#{k}]"
new_meth(v, nm, ev)
}
end
end
```
but it gives error because of nm. how can I fix it? Is it ok to do nm = "#{name}][#{k}" and
ev.set("[#{name}\_null]", value)? but will that work if i have more deep nested hashes? thank you
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 24, 2021, 1:04pm UTC](https://discuss.elastic.co/t/rename-recursively-field-names-in-nested-structure-without-changing-the-structure/290209/4 "2021-12-24T13:04:05Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.