# Ruby filter loop through fields in logstash 5?

**URL:** https://discuss.elastic.co/t/ruby-filter-loop-through-fields-in-logstash-5/72026
**Category:** Logstash
**Created:** [January 18, 2017, 2:39pm UTC](https://discuss.elastic.co/t/ruby-filter-loop-through-fields-in-logstash-5/72026 "2017-01-18T14:39:37Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![Maxwell\_Flanders](https://avatars.discourse-cdn.com/v4/letter/m/eb8c5e/32.png) [@Maxwell\_Flanders](https://discuss.elastic.co/u/Maxwell_Flanders)
#### Post date: [January 18, 2017, 2:39pm UTC](https://discuss.elastic.co/t/ruby-filter-loop-through-fields-in-logstash-5/72026/1 "2017-01-18T14:39:37Z")

</div>

In logstash 2.1 I have been using a ruby filter to loop through all top-level fields and do a gsub to remove some special characters. I know that in 5.0, the Event API has changed significantly with an impact on ruby filters, namely the use of getters and setters instead of directly changing field values. My filter looked like this:

```
ruby {
    code => "
        event.to_hash.each { |k,v|
            v.gsub!('badcharacter', 'replacementChar') if v.is_a?(String)
        }
    "
}

```

The refactoring of the gsub should not be difficult. However, my filter does not specify what fields to replace, it acts on all fields. With the new Event API, is there still functionality like `event.to_hash.each { |k,v|` that would allow me to abstractly apply my gsub filter to all fields??

---

<div class="post-metadata">

### Author: ![Clem\_Bac](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/clem_bac/32/14403_2.png) [@Clem\_Bac](https://discuss.elastic.co/u/Clem_Bac)
#### Post date: [January 20, 2017, 12:46pm UTC](https://discuss.elastic.co/t/ruby-filter-loop-through-fields-in-logstash-5/72026/2 "2017-01-20T12:46:00Z")

</div>

[quote="Maxwell\_Flanders, post:1, topic:72026"]  
have been using a ruby filter to loop through all top-level fields and do a gsub to remove some special characters. I know that in 5.0, the Event API has changed significantly with an impact on ruby filters, namely the use of getters and setters instead of directly changing field values. My

+1 I have the same issue. Did you find a way to solve it ?

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [January 20, 2017, 12:53pm UTC](https://discuss.elastic.co/t/ruby-filter-loop-through-fields-in-logstash-5/72026/3 "2017-01-20T12:53:36Z")

</div>

Isn't to\_hash still available in the event object? Looking at the source code it appears to be.

> <https://github.com/elastic/logstash/blob/v5.1.2/logstash-core-event/lib/logstash/event.rb#L159-L161>

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 17, 2017, 12:53pm UTC](https://discuss.elastic.co/t/ruby-filter-loop-through-fields-in-logstash-5/72026/4 "2017-02-17T12:53:39Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
