# Ruby - First few characters (substring)

**URL:** <https://discuss.elastic.co/t/ruby-first-few-characters-substring/244493>\
**Category:** Logstash\
**Created:** [August 11, 2020, 6:16am UTC](https://discuss.elastic.co/t/ruby-first-few-characters-substring/244493 "2020-08-11T06:16:42Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![bevano](https://avatars.discourse-cdn.com/v4/letter/b/6bbea6/32.png) [@bevano](https://discuss.elastic.co/u/bevano)\
**Post date:** [August 11, 2020, 6:16am UTC](https://discuss.elastic.co/t/ruby-first-few-characters-substring/244493/1 "2020-08-11T06:16:42Z")

</div>

Hey All,

Trying to get the first 4 characters of a field that is obtained via XPATH.

This is what i currently have, but it copies everything rather then the first 4 characters. Been stumped on it for the past couple hours. Open to other methods other then ruby but haven't been able to find any other suggestions

```
ruby {
    code => "event.set('message_code', event.get('hostdata')[0,3])"
}
```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 11, 2020, 2:46pm UTC](https://discuss.elastic.co/t/ruby-first-few-characters-substring/244493/2 "2020-08-11T14:46:04Z")

</div>

Is [hostdata] a string or an array? What does it look like in

```
output { stdout { codec => rubydebug } }
```

---

<div class="post-metadata">

**Author:** ![bevano](https://avatars.discourse-cdn.com/v4/letter/b/6bbea6/32.png) [@bevano](https://discuss.elastic.co/u/bevano)\
**Post date:** [August 11, 2020, 3:04pm UTC](https://discuss.elastic.co/t/ruby-first-few-characters-substring/244493/3 "2020-08-11T15:04:03Z")

</div>

[hostdata] is a string field that is populated earlier via using the XML XPATH. I have also tried adding a mutate/convert prior to ensure that its a string.

Does the syntax look correct?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [August 11, 2020, 3:23pm UTC](https://discuss.elastic.co/t/ruby-first-few-characters-substring/244493/4 "2020-08-11T15:23:44Z")

</div>

> [@bevano](#):
>
> [hostdata] is a string field that is populated earlier via using the XML XPATH

If it was populated using an xml filter and xpath it will be an array unless you have already done

```
mutate { replace => { "hostdata" => "[hostdata][0]" } }

```

---

<div class="post-metadata">

**Author:** ![bevano](https://avatars.discourse-cdn.com/v4/letter/b/6bbea6/32.png) [@bevano](https://discuss.elastic.co/u/bevano)\
**Post date:** [August 12, 2020, 2:09am UTC](https://discuss.elastic.co/t/ruby-first-few-characters-substring/244493/5 "2020-08-12T02:09:46Z")

</div>

Thanks Badger, looks like it was an array 😛. My bad.

Solution for anyone looking for one. This only needed to be populated on certain conditions (thus the if statement). Creates the field I want populated, converts hostdata to a string, then sets message\_code to the first 4 characters.

> ```
> if ("HostRequest" in [action]) {
> mutate{
> add_field => {
> "message_code" => "1"
> }
> replace => {
> "hostdata" => "%{[hostdata][0]}"
> }
> }
> ruby {
> code => "event.set('message_code', event.get('hostdata')[0,4])"
> }
> }
> 
> ```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 9, 2020, 2:09am UTC](https://discuss.elastic.co/t/ruby-first-few-characters-substring/244493/6 "2020-09-09T02:09:53Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.