# Ruby code to add entry into an array?

**URL:** <https://discuss.elastic.co/t/ruby-code-to-add-entry-into-an-array/263046>\
**Category:** Logstash\
**Created:** [February 2, 2021, 9:10pm UTC](https://discuss.elastic.co/t/ruby-code-to-add-entry-into-an-array/263046 "2021-02-02T21:10:29Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![aidanoc15](https://avatars.discourse-cdn.com/v4/letter/a/c89c15/32.png) [@aidanoc15](https://discuss.elastic.co/u/aidanoc15)\
**Post date:** [February 2, 2021, 9:10pm UTC](https://discuss.elastic.co/t/ruby-code-to-add-entry-into-an-array/263046/1 "2021-02-02T21:10:29Z")

</div>

Hi, I'm using logstash as a method posting tickets into our ticketing system using data from an elasticsearch index. The API for out ticketing system expects all of the custom fields for our ticket to come through as an array, I am currently creating this array using the ruby filter, like so:

```auto
 ruby {  
            code => '
                event.set("[ticket][custom_fields]", [
                    {"id" => "12345", "value" => event.get("[field1]")},
                    {"id" => "678910", "value" => event.get("[field2]")},
                    {"id" => "109876", "value" => event.get("[field3]")},
                    {"id" => "54321", "value" => event.get("[field3]")},
                    {"id" => "99999", "value" => event.get("[field4]")},
                    {"id" => "11111", "value" => event.get("[field5]")}
                ])
            ' 
            }

```

Here's where my issue lies, while there are some custom fields that I'm going to want to populate for every single event, there are others that I only want to populate under certain conditions. So is there some way for me to, when that condition is true, append an additional entry into the array?  
I thought I might be able to do something like

```auto
event.set("[ticket][custom_fields]", event.get("[ticket][custom_fields]") + {"id" => "55555", "value" => event.get("[new_field]")}

```

but that would append the new item on after the closing ']' so I don't think that would work. Does the ruby filter in logstash perhaps support some kind of push function? That's what would make the most sense to me (assuming it exists) but couldnt find any examples online of someone trying to do the same thing that I am trying to do.

Of course what I could do is just have it so if the condition is true, i could just completely overwrite the entire [ticket][custom\_fields] object with all the fields that I want added under that condition. However, there are multiple different situations where I would want to add specific fields under specific conditions, and if I wanted to go down that route it would require mountains of duplicated code and just become increasingly hard to maintain.

Anyone have any ideas? Thanks in advance!

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [February 2, 2021, 9:36pm UTC](https://discuss.elastic.co/t/ruby-code-to-add-entry-into-an-array/263046/2 "2021-02-02T21:36:13Z")

</div>

I think you are looking for the [\<\<](https://ruby-doc.org/core-2.7.0/Array.html#method-i-3C-3C) operator.

---

<div class="post-metadata">

**Author:** ![aidanoc15](https://avatars.discourse-cdn.com/v4/letter/a/c89c15/32.png) [@aidanoc15](https://discuss.elastic.co/u/aidanoc15)\
**Post date:** [February 3, 2021, 5:33pm UTC](https://discuss.elastic.co/t/ruby-code-to-add-entry-into-an-array/263046/3 "2021-02-03T17:33:42Z")

</div>

So syntactically how would I accomplish this in the filter?

```auto
temp = event.get("[ticket][custom_fields]") << {"id" => "55555", "value" => event.get("[new_field]")}
event.set("[ticket][custom_fields]", temp)

```

Does this make sense? Sorry somewhat new to the ruby filter.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [February 3, 2021, 5:37pm UTC](https://discuss.elastic.co/t/ruby-code-to-add-entry-into-an-array/263046/4 "2021-02-03T17:37:10Z")

</div>

That looks reasonable.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 3, 2021, 5:38pm UTC](https://discuss.elastic.co/t/ruby-code-to-add-entry-into-an-array/263046/5 "2021-03-03T17:38:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.