# Set "fields" into array - SOLVED

**URL:** <https://discuss.elastic.co/t/set-fields-into-array-solved/73995>\
**Category:** Logstash\
**Created:** [February 5, 2017, 9:25pm UTC](https://discuss.elastic.co/t/set-fields-into-array-solved/73995 "2017-02-05T21:25:33Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![adrianolimit](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrianolimit/32/11930_2.png) [@adrianolimit](https://discuss.elastic.co/u/adrianolimit)\
**Post date:** [February 5, 2017, 9:25pm UTC](https://discuss.elastic.co/t/set-fields-into-array-solved/73995/1 "2017-02-05T21:25:33Z")

</div>

Hello everyone,

I'm using the "Twitter input" and I want to put in lowercase one field, I tried some things but I didn't success ... I know that there are few changes since Logstash 5.0 (I'm using Logstash 5.1.1) with the "event API" and I don't understand how it works. This is my input data :

```
   "entities": {
            "hashtags": [
              {
                "indices": [
                  10,
                  16
                ],
                "text": "data"
              },...
            ]           
         },...
        }

```

But in my ruby filter in Logstash, the "hashtags" data seem to be "hash values" :

```
"entities": {
            "hashtags": [
              {
                      "indices"=> [10, 16],
                      "text" => "DATA"
               },...
            ]
         },...
        }

```

So, this is my ruby filter :

```
if ([entities][hashtags]) {
   ruby {
      code => '			
	     event.get("[entities][hashtags]").each {|hash|
	          hash.each { |key,value|
		     if key == "text"
		           event.tag(value.downcase) # Works, create an array of lowercase values in the field "tags"
			   event.set("[entities][hashtags]"[hash][key], value.downcase) #Doesn't work, create an error
			   key= value.downcase # Doesn't work
                           value = value.downcase # Doesn't work			
  		      end
	          }
	       }'
          }
      }

```

I don't known what I have to do, I tried lot of things and I'm losing my mind.

Thank you in advance.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 6, 2017, 7:08am UTC](https://discuss.elastic.co/t/set-fields-into-array-solved/73995/2 "2017-02-06T07:08:24Z")

</div>

> ```
> event.set("[entities][hashtags]"[key][k], value.downcase) #Doesn't work, create an error
> 
> ```

Yes, that's not surprising. Try

```
event.set("[entities][hashtags][#{key}][#{k}]", value.downcase)

```

to insert the values of `key` and `k` into the string.

---

<div class="post-metadata">

**Author:** ![adrianolimit](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrianolimit/32/11930_2.png) [@adrianolimit](https://discuss.elastic.co/u/adrianolimit)\
**Post date:** [February 6, 2017, 9:10am UTC](https://discuss.elastic.co/t/set-fields-into-array-solved/73995/3 "2017-02-06T09:10:17Z")

</div>

Hello Magnus,

I tried your solution :

`event.set("[entities][hashtags][#{hash}][#{key}]", value.downcase)`

And I obtained this error message :

`[ERROR][logstash.filters.ruby] Ruby exception occurred: For input string: "{"indices"=>"`

I don't understand because in my filter I test if "k == text" before to try to set the value :

```
event.get("[entities][hashtags]").each {|hash|
	hash.each { |key,value|
		if key == "text"
			event.tag(value.downcase)
			event.set("[entities][hashtags][#{hash}][#{key}]", value.downcase)
		end
	}
}'

```

Do you have any idea?

---

<div class="post-metadata">

**Author:** ![adrianolimit](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrianolimit/32/11930_2.png) [@adrianolimit](https://discuss.elastic.co/u/adrianolimit)\
**Post date:** [February 6, 2017, 11:45am UTC](https://discuss.elastic.co/t/set-fields-into-array-solved/73995/4 "2017-02-06T11:45:44Z")

</div>

In the event that some people could have the same problem as me, I solved my problem with this code:

```
if ([entities][hashtags]) {
    ruby {
	   code => '	
	       i = 0
	       event.get("[entities][hashtags]").each {|hash|
		   event.set("[entities][hashtags][#{i}][text]",event.get("[entities][hashtags][#{i}][text]").downcase)
		   i += 1
	    }'
     }}

```

I could also used this code, (but for me it is slower that the first) :

```
if ([entities][hashtags]) {
    ruby {
	 code => '	
	      i = 0
	      event.get("[entities][hashtags]").each {|hash|
		   hash.each { |key,value|
			if key == "text"
				event.set("[entities][hashtags][#{i}][text]",value.downcase)
			end
		    }
		    i += 1
	       }'
        }
}

```

@magnusbaeck, In your opinion, what is the best code?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 6, 2017, 11:46am UTC](https://discuss.elastic.co/t/set-fields-into-array-solved/73995/5 "2017-03-06T11:46:26Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.