# Ruby to expand nested array field into nested JSON objects

**URL:** <https://discuss.elastic.co/t/ruby-to-expand-nested-array-field-into-nested-json-objects/153753>\
**Category:** Logstash\
**Created:** [October 24, 2018, 9:01am UTC](https://discuss.elastic.co/t/ruby-to-expand-nested-array-field-into-nested-json-objects/153753 "2018-10-24T09:01:09Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![dx123](https://avatars.discourse-cdn.com/v4/letter/d/d9b06d/32.png) [@dx123](https://discuss.elastic.co/u/dx123)\
**Post date:** [October 24, 2018, 9:01am UTC](https://discuss.elastic.co/t/ruby-to-expand-nested-array-field-into-nested-json-objects/153753/1 "2018-10-24T09:01:09Z")

</div>

This is an example format of a JSON field that I have now and wish to convert:

```
{
	"target": [
		"Sector1 - Subsector1",
		"Sector2 - Subsector2"
	]
}

```

The end result desired JSON Objects Output format that I need:

```
{
	"target": [{
		"Sector": "Sector1",
		"Subsector": "Subsector1"
	}, {
		"Sector": "Sector2",
		"Subsector": "Subsector2"
	}]
}

```

I used 2 sector-sub sector pairs in the example above, however in my data it is not just restricted to a 2 pair; they could be a 1 pair or 3 pair as well. Hence I need a code template that can accommodate all scenarios.

I've done some research and found out most answers given related to this topic used the Logstash Ruby filter, but there wasn't a exact example that I could follow, I am not proficient in Ruby language so if anyone here can help with the Ruby code to perform the above dynamic conversion it will be very much appreciated!

---

<div class="post-metadata">

**Author:** ![balumurari1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/balumurari1/32/39203_2.png) [@balumurari1](https://discuss.elastic.co/u/balumurari1)\
**Post date:** [October 29, 2018, 7:42am UTC](https://discuss.elastic.co/t/ruby-to-expand-nested-array-field-into-nested-json-objects/153753/2 "2018-10-29T07:42:29Z")

</div>

you need to use aggregate function, to load the data

---

<div class="post-metadata">

**Author:** ![dx123](https://avatars.discourse-cdn.com/v4/letter/d/d9b06d/32.png) [@dx123](https://discuss.elastic.co/u/dx123)\
**Post date:** [October 30, 2018, 3:49am UTC](https://discuss.elastic.co/t/ruby-to-expand-nested-array-field-into-nested-json-objects/153753/3 "2018-10-30T03:49:29Z")

</div>

Can you elaborate more on this, or provide an example?

---

<div class="post-metadata">

**Author:** ![paz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/paz/32/28003_2.png) [@paz](https://discuss.elastic.co/u/paz)\
**Post date:** [October 30, 2018, 7:55am UTC](https://discuss.elastic.co/t/ruby-to-expand-nested-array-field-into-nested-json-objects/153753/4 "2018-10-30T07:55:27Z")

</div>

Try this snippet to see if it suits your needs.

```auto
filter {
    ruby {
        code => "
            arr = []
            event.get('target').each { |k| arr << {:Sector => k.split(' - ')[0], :Subsector => k.split(' - ')[1]} }
            event.set('target', arr)
        "
    }
}

```

---

<div class="post-metadata">

**Author:** ![dx123](https://avatars.discourse-cdn.com/v4/letter/d/d9b06d/32.png) [@dx123](https://discuss.elastic.co/u/dx123)\
**Post date:** [October 30, 2018, 9:29am UTC](https://discuss.elastic.co/t/ruby-to-expand-nested-array-field-into-nested-json-objects/153753/5 "2018-10-30T09:29:06Z")

</div>

I tried your code, unfortunately it returned the same result as my original format.

---

<div class="post-metadata">

**Author:** ![paz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/paz/32/28003_2.png) [@paz](https://discuss.elastic.co/u/paz)\
**Post date:** [October 30, 2018, 9:33am UTC](https://discuss.elastic.co/t/ruby-to-expand-nested-array-field-into-nested-json-objects/153753/6 "2018-10-30T09:33:36Z")

</div>

Yeah, my bad. Was a failed copy/paste on my end. Fixed it above, try it now.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 27, 2018, 9:33am UTC](https://discuss.elastic.co/t/ruby-to-expand-nested-array-field-into-nested-json-objects/153753/7 "2018-11-27T09:33:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.