# Ruby code to split array message and get the index and value in logstash

**URL:** <https://discuss.elastic.co/t/ruby-code-to-split-array-message-and-get-the-index-and-value-in-logstash/85075>\
**Category:** Logstash\
**Created:** [May 9, 2017, 11:47am UTC](https://discuss.elastic.co/t/ruby-code-to-split-array-message-and-get-the-index-and-value-in-logstash/85075 "2017-05-09T11:47:26Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Aditya\_Srivastava](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aditya_srivastava/32/43287_2.png) [@Aditya\_Srivastava](https://discuss.elastic.co/u/Aditya_Srivastava)\
**Post date:** [May 9, 2017, 11:47am UTC](https://discuss.elastic.co/t/ruby-code-to-split-array-message-and-get-the-index-and-value-in-logstash/85075/1 "2017-05-09T11:47:27Z")

</div>

I am new to ruby code. Will appreciate any help on this.

my input is  
message =\> field id="0" value="01"/\>\n field id="3" value="03"/\>\n \<field  
id="5" value="05"/\>\n field id="7" value="07"/\>\n \<field id="9"  
value="09"/\>\n /isomsg\>\n"

I have applied kv filter here

kv {  
source =\> "message"  
trim =\> """  
trimkey =\> """  
field\_split =\> " "  
value\_split =\> "="  
}

The output I receive is  
"id" =\> [  
[0] "0",  
[1] "3",  
[2] "5",  
[3] "7",  
[4] "9"  
],  
"value" =\> [  
[0] "01",  
[1] "03",  
[2] "05",  
[3] "07",  
[4] "09"  
],

Now I want to write a ruby code where I can extract the id and value wrt to index

The ruby code should be in loop and check , if id[index] == "7"  
event['thisvalue'] = value[index]

Means first find the index where id is 7(say indexA = 3) and then extract the value at indexA(which should be 07) and store this value as a field.

For this, the code i wrote is

ruby {  
code =\> "  
times = event['id'].split(',')  
times.each\_index { |i| event[i.to\_s] = times[i]  
if times[i] == "7"  
event['IndexValue'] = i}  
"  
}  
This code should at-least give me index where the value for "id" is 7 which is not happening and I get ruby fail exception as a tag.

"tags" =\> [  
[0] "\_rubyexception"  
],

Please some one help me with the ruby code part.  
Also Please provide me with some link where I can learn atleast the basic concepts of ruby(this use case is just the beginning for me)

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [May 9, 2017, 11:55am UTC](https://discuss.elastic.co/t/ruby-code-to-split-array-message-and-get-the-index-and-value-in-logstash/85075/2 "2017-05-09T11:55:55Z")

</div>

Please don't start multiple threads asking the same thing.

---

<div class="post-metadata">

**Author:** ![Aditya\_Srivastava](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aditya_srivastava/32/43287_2.png) [@Aditya\_Srivastava](https://discuss.elastic.co/u/Aditya_Srivastava)\
**Post date:** [May 9, 2017, 12:08pm UTC](https://discuss.elastic.co/t/ruby-code-to-split-array-message-and-get-the-index-and-value-in-logstash/85075/3 "2017-05-09T12:08:47Z")

</div>

Ya [sure.My](http://sure.My) mistake.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 6, 2017, 12:14pm UTC](https://discuss.elastic.co/t/ruby-code-to-split-array-message-and-get-the-index-and-value-in-logstash/85075/4 "2017-06-06T12:14:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.