# Ruby for loop logstash
**URL:** https://discuss.elastic.co/t/ruby-for-loop-logstash/355946
**Category:** Logstash
**Created:** [March 21, 2024, 9:28pm UTC](https://discuss.elastic.co/t/ruby-for-loop-logstash/355946 "2024-03-21T21:28:53Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@Johnson\_will](https://discuss.elastic.co/u/Johnson_will)
#### Post date: [March 21, 2024, 9:28pm UTC](https://discuss.elastic.co/t/ruby-for-loop-logstash/355946/1 "2024-03-21T21:28:53Z")
I am trying to convert the epoch timestamps which comes in an array.
````auto
"steps": [
{
"number": 1,
"status": "COMPLETE",
"doRetry": null,
"progress": null,
"startTime": 1710431698,
"rowCount": null,
"endTime": 1710431699
},
{
"number": 2,
"status": null,
"startTime": 1710431698,
"doRetry": null,
"progress": null
},
{
"number": 3,
"status": "COMPLETE",
"startTime": 1710431698,
"doRetry": null,
"progress": null,
"endTime": 1710431734,
"rowCount": null
},
{
"number": 4,
"status": null,
"doRetry": null,
"progress": null
},
{
"number": 5,
"status": null,
"doRetry": null,
"startTime": 1710431698,
"progress": null
},
{
"number": 6,
"status": null,
"doRetry": null,
"endTime": 1710431734,
"progress": null
}
]
```
Here is my ruby and date filter
```
if [steps][startTime] {ruby{code => "event.set('endTime',event.get('endTime').to_i* 1000)"}}
if [steps][endTime] {ruby{code => "event.set('endTime',event.get('endTime').to_i* 1000)"}}
date {
match => ["[steps][startTime]","UNIX_MS" ]
target => "[steps][startTime]"
timezone => "America/Toronto"
}
date {
match => ["[steps][endTime]","UNIX_MS" ]
target => "[steps][endTime]"
timezone => "America/Toronto"
}
````
it didn't work
Note: startTime and endTime doesn't come in each index of array.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [March 21, 2024, 10:38pm UTC](https://discuss.elastic.co/t/ruby-for-loop-logstash/355946/2 "2024-03-21T22:38:59Z")
> [@Johnson\_will](#):
>
> ```auto
> date {
> match => ["[steps][startTime]","UNIX_MS" ]
> target => "[steps][startTime]"
> timezone => "America/Toronto"
> }
>
> ```
If you want to add the timestamps under [steps] then you will need to remove\_field the array of hashes. Your timestamps are seconds, not milliseconds, so use UNIX.
```
ruby {
code => '
steps = event.get("steps")
if steps.is_a? Array
steps.each { |x|
if x["endTime"] then event.set("[@metadata][endTime]", x["endTime"]) ; end
if x["startTime"] then event.set("[@metadata][startTime]", x["startTime"]) ; end
}
end
'
remove_field => ["steps"]
}
date {
match => ["[@metadata][startTime]","UNIX" ]
target => "[steps][startTime]"
timezone => "America/Toronto"
}
```
---
### Author:  [@Johnson\_will](https://discuss.elastic.co/u/Johnson_will)
#### Post date: [March 22, 2024, 1:06am UTC](https://discuss.elastic.co/t/ruby-for-loop-logstash/355946/3 "2024-03-22T01:06:40Z")
Thanks @Badger for your quick response, instead of removing the field, I would like to rename it to some other name because their are these two fields startTime and endTime coming in the api data which is not included in my question. So there would be just startTime and endTime fields also [steps][startTime] and [steps][endTime]
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [March 22, 2024, 1:28am UTC](https://discuss.elastic.co/t/ruby-for-loop-logstash/355946/4 "2024-03-22T01:28:09Z")
> [@Johnson\_will](#):
>
> instead of removing the field, I would like to rename it
OK, so use [mutate+rename](https://www.elastic.co/guide/en/logstash/current/plugins-filters-mutate.html#plugins-filters-mutate-rename).
---
### Author:  [@Johnson\_will](https://discuss.elastic.co/u/Johnson_will)
#### Post date: [March 22, 2024, 3:27am UTC](https://discuss.elastic.co/t/ruby-for-loop-logstash/355946/5 "2024-03-22T03:27:18Z")
Thanks @Badger
1. For some reason, date filter UNIX doesn't work. only UNIX\_MS works, so i am multiplying with 1000 to get converted into milliseconds.
2. Thanks for this code, it works but i need to multiply it with 1000 to convert into milliseconds and use UNIX\_MS.
```auto
ruby {
code => '
steps = event.get("steps")
if steps.is_a? Array
steps.each { |x|
if x["endTime"] then event.set("[@metadata][endTime]", x["endTime"]) ; end
if x["startTime"] then event.set("[@metadata][startTime]", x["startTime"]) ; end
}
end
'
}
mutate {
rename => { "steps" => "Steps" }
}
date {
match => ["[@metadata][startTime]","UNIX" ]
target => "[steps][startTime]"
timezone => "America/Toronto"
}
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 19, 2024, 3:27am UTC](https://discuss.elastic.co/t/ruby-for-loop-logstash/355946/6 "2024-04-19T03:27:20Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.