# Revome over gsub()
**URL:** https://discuss.elastic.co/t/revome-over-gsub/306460
**Category:** Logstash
**Created:** [June 6, 2022, 1:59pm UTC](https://discuss.elastic.co/t/revome-over-gsub/306460 "2022-06-06T13:59:52Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@Iss](https://discuss.elastic.co/u/Iss)
#### Post date: [June 6, 2022, 1:59pm UTC](https://discuss.elastic.co/t/revome-over-gsub/306460/1 "2022-06-06T13:59:52Z")
Hi!
I have nested field as :
```auto
"statement" => {
"cntxt" => {
"extension" => {
"https://ssss/xp/w/yy" => "xxxxxxx"
}
},
...
}
```
the field "extension" is dynamic. I want to remove "[https://ssss/xp/](https://ssss/xp/)" to get
```auto
"statement" => {
"cntxt" => {
"extension" => {
"w/yy" => "xxxxxxx"
}
},
...
}
```
After fiew review in this discuss forum I tried with
```auto
ruby {
code => "
hash = event.to_hash
hash.each do |k,v|
if k.start_with?'https://ssss/xp/'
event.set(k.gsub('https://ssss/xp/',''), v)
end
end
"
}
}
```
But it's not work.
Thanks for your help !
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 6, 2022, 3:38pm UTC](https://discuss.elastic.co/t/revome-over-gsub/306460/2 "2022-06-06T15:38:27Z")
> [@Iss](#):
>
> `hash.each do |k,v|`
That just iterates over the top level entries in the hash. If you need to recursively descend into hashes or arrays then you need something more like [this](https://discuss.elastic.co/t/how-to-exclude-xml-json-key-value-if-key-length-is-greater-than-15-char-and-value-length-is-greater-than-100-char/270248/8).
---
### Author:  [@Iss](https://discuss.elastic.co/u/Iss)
#### Post date: [June 6, 2022, 11:45pm UTC](https://discuss.elastic.co/t/revome-over-gsub/306460/3 "2022-06-06T23:45:14Z")
Ok,
I tried to adapt your code like below
```auto
ruby {
code => '
def removePartStings(object, name, event)
if object
if object.kind_of?(Hash) and object != {}
object.each { |k, v| removePartStings(v, "#{name}[#{k}]", event) }
elsif object.kind_of?(Array) and object != []
object.each_index { |i|
removePartStings(object[i], "#{name}[#{i}]", event)
}
else
lastElement = name.gsub(/^.*\[/, "").gsub(/\]$/, "")
if lastElement.start_with?("https://ssss/xp/")
event.set(lastElement.gsub("https://ssss/xp/)","_"), event.remove(name))
end
end
end
end
event.to_hash.each { |k, v|
removePartStings(v, "[#{k}]", event)
}
'
}
```
I know that is not correct (it not works) but I do can't do better. Any correction will help. Thanks
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 7, 2022, 12:42am UTC](https://discuss.elastic.co/t/revome-over-gsub/306460/4 "2022-06-07T00:42:51Z")
```
event.set(lastElement.gsub("https://ssss/xp/)","_"), event.remove(name))`
^
```
Remove that parenthesis and you will get a top level field
```
"_w/yy" => "xxxxxxx",
```
Also, I recently learned that defining the function in the code option is a big performance hit. Do it in the init option...
```
ruby {
init => '
def removePartStings(object, name, event)
if object
if object.kind_of?(Hash) and object != {}
object.each { |k, v| removePartStings(v, "#{name}[#{k}]", event) }
elsif object.kind_of?(Array) and object != []
object.each_index { |i|
removePartStings(object[i], "#{name}[#{i}]", event)
}
else
lastElement = name.gsub(/^.*\[/, "").gsub(/\]$/, "")
if lastElement.start_with?("https://ssss/xp/")
event.set(lastElement.gsub("https://ssss/xp/","_"), event.remove(name))
end
end
end
end
'
code => '
event.to_hash.each { |k, v|
removePartStings(v, "[#{k}]", event)
}
'
}
```
---
### Author:  [@Iss](https://discuss.elastic.co/u/Iss)
#### Post date: [June 7, 2022, 6:46am UTC](https://discuss.elastic.co/t/revome-over-gsub/306460/5 "2022-06-07T06:46:29Z")
> [@Badger](#):
>
> ```auto
> elsif object.kind_of?(Array) and object != []
> object.each_index { |i|
> removePartStings(object[i], "#{name}[#{i}]", event)
> }
> else
> lastElement = name.gsub(/^.*\[/, "").gsub(/\]$/, "")
> if lastElement.start_with?("https://ssss/xp/")
> event.set(lastElement.gsub("https://ssss/xp/","_"), event.remove(name))
> end
> end
> end
> end
> '
> code => '
> event.to_hash.each { |k, v|
> removePartStings(v, "[#{k}]", event)
> }
> '
> }
>
> ```
Thank you!!! It works
---
### Author:  [@Iss](https://discuss.elastic.co/u/Iss)
#### Post date: [June 7, 2022, 10:44am UTC](https://discuss.elastic.co/t/revome-over-gsub/306460/6 "2022-06-07T10:44:21Z")
Last question about it.
Where to modify if we want to apply it (the recusive function) to values (not keys) using another starting string word (say not "[https://ssss/xp/](https://ssss/xp/)" but "xt") or if any, apply simultaneously two conditional changes with a same function?
I tried to add changes to do that but no effect as result.
Thank a lot!!!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 5, 2022, 10:44am UTC](https://discuss.elastic.co/t/revome-over-gsub/306460/7 "2022-07-05T10:44:35Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.