# Ruby filter usage to divide value and create new events

**URL:** https://discuss.elastic.co/t/ruby-filter-usage-to-divide-value-and-create-new-events/75020
**Category:** Logstash
**Created:** [February 14, 2017, 11:58am UTC](https://discuss.elastic.co/t/ruby-filter-usage-to-divide-value-and-create-new-events/75020 "2017-02-14T11:58:30Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![pavlik](https://avatars.discourse-cdn.com/v4/letter/p/97f17d/32.png) [@pavlik](https://discuss.elastic.co/u/pavlik)
#### Post date: [February 14, 2017, 11:58am UTC](https://discuss.elastic.co/t/ruby-filter-usage-to-divide-value-and-create-new-events/75020/1 "2017-02-14T11:58:30Z")

</div>

Hello,

I have the following event:

```
             "message" => "2017-01-02 08:00;2017-01-02 09:00;30;Item1, Item2, Item3",
            "@version" => "1",
          "@timestamp" => "2017-01-02T08:00:00.000Z",
                "host" => "xxx",
                "type" => "aaa",
               "stopt" => "2017-01-02 09:00",
                "time" => 24,
               "items" => "Item1, Item2, Item3",

```

and based on that I would like to:  
1.Create new, separate event for every item on **items** list  
2.Divide the **time** value by the total number of items (e.g. we have 24 and 3 items total - so every new event should have **"time" =\> 8** )  
3.Delete the original event

so the first new event should look like below:

```
"message" => "2017-01-02 08:00;2017-01-02 09:00;30;Item1",
            "@version" => "1",
          "@timestamp" => "2017-01-02T08:00:00.000Z",
                "host" => "xxx",
                "type" => "aaa",
               "stopt" => "2017-01-02 09:00",
                "time" => 8,
               "items" => "Item1",
                "tags" => [

```

I'm not able to achive this using the built-in Logstash filters so **ruby()** is the only solution. Can you help me with that?

Thanks in advance  
PaVliK

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [February 17, 2017, 8:36am UTC](https://discuss.elastic.co/t/ruby-filter-usage-to-divide-value-and-create-new-events/75020/2 "2017-02-17T08:36:18Z")

</div>

You can use the mutate filter's split option to turn the `items` string into an array. After that the following ruby filter (for Logstash 2.4+) should take care of the division:

```nohighlight
ruby {
  code => "event.set('time', event.get('time') / event.get('items').length) unless event.get('time').nil?"
}

```

Finally, use the clone filter on the `items` field to split the original event in multiple copies.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 17, 2017, 8:36am UTC](https://discuss.elastic.co/t/ruby-filter-usage-to-divide-value-and-create-new-events/75020/3 "2017-03-17T08:36:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.