# Ruby filter - how to access JSON fields when using the json codec

**URL:** <https://discuss.elastic.co/t/ruby-filter-how-to-access-json-fields-when-using-the-json-codec/116071>\
**Category:** Logstash\
**Created:** [January 18, 2018, 2:03pm UTC](https://discuss.elastic.co/t/ruby-filter-how-to-access-json-fields-when-using-the-json-codec/116071 "2018-01-18T14:03:54Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![anon24174512](https://avatars.discourse-cdn.com/v4/letter/a/eb8c5e/32.png) [@anon24174512](https://discuss.elastic.co/u/anon24174512)\
**Post date:** [January 18, 2018, 2:03pm UTC](https://discuss.elastic.co/t/ruby-filter-how-to-access-json-fields-when-using-the-json-codec/116071/1 "2018-01-18T14:03:55Z")

</div>

Dear all,

I have two payload.longitude and payload.latitude fields I can display in Kibana. There type in the elasticsearch mapping is float.

I want to divide them by 1000000 and set the values of the corresponding lat/lon of a geopoint.

Here is my logstash filter :

> ```
> filter {
> ruby {
> code => "
> lat = event.get('[payload.latitude]').to_f / 10000000
> lon = event.get('[payload.longitude]').to_f / 10000000
> event.set('[coordinate][lat]', lat)
> event.set('[coordinate][lon]', lon)
> "
> }
> }
> 
> ```

This results in a geopoint with lat/lon equal to zero. I am using the json codec, so I believe the problem is how to access json fields ?

Thanks,

---

<div class="post-metadata">

**Author:** ![paz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/paz/32/28003_2.png) [@paz](https://discuss.elastic.co/u/paz)\
**Post date:** [January 18, 2018, 2:43pm UTC](https://discuss.elastic.co/t/ruby-filter-how-to-access-json-fields-when-using-the-json-codec/116071/2 "2018-01-18T14:43:09Z")

</div>

Are those latitude/longitude fields supposed to be nested fields under payload in the original event? Unless it's a wrong field reference, or a typo in the field name it should work. I tested it on 5.6 as a single field (not nested) and works fine.

Btw, you can use _.get_ methods inside _.set_ to make your code a bit more concise

```auto
filter {
  ruby {
    code => "
      event.set('[coordinate][lat]', event.get('payload.latitude').to_f / 10000000)
      event.set('[coordinate][lon]', event.get('payload.longitude').to_f / 10000000)
    "
  }
}
```

---

<div class="post-metadata">

**Author:** ![anon24174512](https://avatars.discourse-cdn.com/v4/letter/a/eb8c5e/32.png) [@anon24174512](https://discuss.elastic.co/u/anon24174512)\
**Post date:** [January 18, 2018, 5:10pm UTC](https://discuss.elastic.co/t/ruby-filter-how-to-access-json-fields-when-using-the-json-codec/116071/3 "2018-01-18T17:10:34Z")

</div>

Thanks for the answer, here an example of a json line :

> { "version" : "1", "payload" : { "longitude" : "193654098", "latitude" : "483751298" } }

So I guess payload is nested field or is the definition of nested different ?

---

<div class="post-metadata">

**Author:** ![paz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/paz/32/28003_2.png) [@paz](https://discuss.elastic.co/u/paz)\
**Post date:** [January 18, 2018, 5:58pm UTC](https://discuss.elastic.co/t/ruby-filter-how-to-access-json-fields-when-using-the-json-codec/116071/4 "2018-01-18T17:58:44Z")

</div>

In that example the nested (children) fields are _longitude_ and _latitude_, the _payload_ is the parent field.

So in order to properly reference them, you need to do so like your _coordinate_ field, as in [_parent_][_child_]

```auto
filter {
  ruby {
    code => "
      event.set('[coordinate][lat]', event.get('[payload][latitude]').to_f / 10000000)
      event.set('[coordinate][lon]', event.get('[payload][longitude]').to_f / 10000000)
    "
  }
}
```

---

<div class="post-metadata">

**Author:** ![anon24174512](https://avatars.discourse-cdn.com/v4/letter/a/eb8c5e/32.png) [@anon24174512](https://discuss.elastic.co/u/anon24174512)\
**Post date:** [January 18, 2018, 6:09pm UTC](https://discuss.elastic.co/t/ruby-filter-how-to-access-json-fields-when-using-the-json-codec/116071/5 "2018-01-18T18:09:01Z")

</div>

Indeed I just tried it and it works. Thank you !

---

<div class="post-metadata">

**Author:** ![anon24174512](https://avatars.discourse-cdn.com/v4/letter/a/eb8c5e/32.png) [@anon24174512](https://discuss.elastic.co/u/anon24174512)\
**Post date:** [January 19, 2018, 6:46am UTC](https://discuss.elastic.co/t/ruby-filter-how-to-access-json-fields-when-using-the-json-codec/116071/6 "2018-01-19T06:46:14Z")

</div>

Just for any people looking for converting numbers to Geopoint, only two gigits after coma is allowed so it leads to the following :

filter {  
ruby {  
code =\> "  
event.set('[coordinate][lat]', (event.get('[payload][latitude]').to\_f / 10000000).round(2))  
event.set('[coordinate][lon]', (event.get('[payload][longitude]').to\_f / 10000000).round(2))  
"  
}  
}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 16, 2018, 6:46am UTC](https://discuss.elastic.co/t/ruby-filter-how-to-access-json-fields-when-using-the-json-codec/116071/7 "2018-02-16T06:46:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.