# Ruby Code to split key value pair in Logstash 6.8.0
**URL:** https://discuss.elastic.co/t/ruby-code-to-split-key-value-pair-in-logstash-6-8-0/275933
**Category:** Logstash
**Created:** [June 15, 2021, 5:16am UTC](https://discuss.elastic.co/t/ruby-code-to-split-key-value-pair-in-logstash-6-8-0/275933 "2021-06-15T05:16:14Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@Santy](https://discuss.elastic.co/u/Santy)
#### Post date: [June 15, 2021, 5:16am UTC](https://discuss.elastic.co/t/ruby-code-to-split-key-value-pair-in-logstash-6-8-0/275933/1 "2021-06-15T05:16:14Z")
```auto
json
{
source => "message"
}
split {
field => "data"
}
date {
match => ["[data][currentDate]", "yyyy-MM-dd HH:mm:ss"]
target => "@timestamp"
}
ruby {
code => "
event['data'].each {|k, v|
event[k] = v
}
event.remove('data')
"
}
```
This was used earlier in logstash 1.5 to split key value pair from a field called "data". Currently we need to migrate to logstash 6.8.0, Could someone help me for this?
Currently i'm using the below ruby code, it is not working properly
```auto
ruby {
code => "
event.get('data').each {|k, v|
event.set(k, v)
}
event.remove('data')
"
}
```
Example of data field is:
{"data":[{"key1":"value1","key2":"value2","key3":"value3", etc}]} Like this the log has key: value more than 20
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 15, 2021, 2:20pm UTC](https://discuss.elastic.co/t/ruby-code-to-split-key-value-pair-in-logstash-6-8-0/275933/2 "2021-06-15T14:20:51Z")
> [@Santy](#):
>
> {"data":[{"key1":"value1","key2":"value2","key3":"value3", etc}]}
That shows data is an array, so the .each will return the hash, not the key value pairs. You could try event.get('[data][0]').each
---
### Author:  [@Santy](https://discuss.elastic.co/u/Santy)
#### Post date: [June 16, 2021, 10:35am UTC](https://discuss.elastic.co/t/ruby-code-to-split-key-value-pair-in-logstash-6-8-0/275933/3 "2021-06-16T10:35:42Z")
```auto
ruby {
code => "
event.get('[data][0]').each {|k, v|
event.set(k, v)
}
event.remove('data')
"
}
```
Hi @Badger , i tried the above one and getting logs with \_rubyexception
in nohup file i'm getting this
**Ruby exception occurred: undefined method `each' for nil:NilClass**
Also i came to know that we are receiving logs like this also
{"data":[{"key1":"value1","key2":"value2","key3":"value3", etc}, {}, {"key1":"value1","key2":"value2","key3":"value3", etc}]}
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 16, 2021, 4:28pm UTC](https://discuss.elastic.co/t/ruby-code-to-split-key-value-pair-in-logstash-6-8-0/275933/4 "2021-06-16T16:28:49Z")
> [@Santy](#):
>
> Ruby exception occurred: undefined method `each' for nil:NilClass
That is telling you that [data][0] does not exist. If it is not present on all events then you could try changing
```auto
event.get('[data][0]').each {|k, v|
event.set(k, v)
}
event.remove('data')
```
to
```
d = event.get('[data][0]')
if d
d.each {|k, v|
event.set(k, v)
}
event.remove('data')
end
```
---
### Author:  [@Santy](https://discuss.elastic.co/u/Santy)
#### Post date: [June 18, 2021, 5:13am UTC](https://discuss.elastic.co/t/ruby-code-to-split-key-value-pair-in-logstash-6-8-0/275933/5 "2021-06-18T05:13:16Z")
```auto
ruby {
code => "
d = event.get('[data]')
if d
d.each {|k, v|
event.set(k, v)
}
event.remove('data')
end
"
}
```
Thanks @Badger This one is working fine, anyway to avoid empty '{}' log i have dropped it from LS itself.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 16, 2021, 5:14am UTC](https://discuss.elastic.co/t/ruby-code-to-split-key-value-pair-in-logstash-6-8-0/275933/6 "2021-07-16T05:14:09Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.