# Renaming/deleting inner array hash field with ruby

**URL:** https://discuss.elastic.co/t/renaming-deleting-inner-array-hash-field-with-ruby/152531
**Category:** Logstash
**Created:** [October 15, 2018, 4:03pm UTC](https://discuss.elastic.co/t/renaming-deleting-inner-array-hash-field-with-ruby/152531 "2018-10-15T16:03:58Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![jclose](https://avatars.discourse-cdn.com/v4/letter/j/df705f/32.png) [@jclose](https://discuss.elastic.co/u/jclose)
#### Post date: [October 15, 2018, 4:03pm UTC](https://discuss.elastic.co/t/renaming-deleting-inner-array-hash-field-with-ruby/152531/1 "2018-10-15T16:03:58Z")

</div>

I'm receiving some data, and one of the fields is dynamically named with a number. So it can come out as `field_1` or `field_28` within a hash.

This is inside of an array, which is inside of a hash.

So, for example, the raw message coming across looks like this:  
`{"header_field":"data","header_offset":"1234", "docs":[{"field_1":"date","doctype":"mystring"}]}`, which means `field_1` is a hash entry at array index 0 inside of the main hash.

I want to rename the dynamic field name to something standard, say `field_date`. This will make it a lot easier on the Elastic side.

I've looked around and tried different examples, notably [this one](https://discuss.elastic.co/t/renaming-nested-fields/134462/10), but I cannot get it to work.

Here is what I have so far. I've gotta be missing some small detail.

```
ruby {
    code => '  
        event.get("docs").each do |k|
           keys = k.keys
           keys.each do |key|
               if ( key =~ /field_[0-9]+/ )
                   k.delete(key)
               end
           end
        end
    '
}

```

This does not work though. I can print the keys and see them all, so I know I'm at least accessing them. But I cannot seem to delete one, or to copy and paste its value into a new variable and then delete.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 12, 2018, 4:04pm UTC](https://discuss.elastic.co/t/renaming-deleting-inner-array-hash-field-with-ruby/152531/2 "2018-11-12T16:04:01Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.