# \[SOLVED\] Split filter question a.k.a flatten json sub array

**URL:** https://discuss.elastic.co/t/solved-split-filter-question-a-k-a-flatten-json-sub-array/130481
**Category:** Logstash
**Created:** [May 3, 2018, 2:53pm UTC](https://discuss.elastic.co/t/solved-split-filter-question-a-k-a-flatten-json-sub-array/130481 "2018-05-03T14:53:55Z")
**Posts on this page:** 1
**Showing post:** 12

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [May 3, 2018, 6:17pm UTC](https://discuss.elastic.co/t/solved-split-filter-question-a-k-a-flatten-json-sub-array/130481/12 "2018-05-03T18:17:09Z")

</div>

So what does output { stdout { codec =\> rubydebug } } produce, and what don't you like about it?

My guess is you will end up wanting something like

```auto
  ruby {
    code => '
      event.get("[Request][Headers]").each { |a|
        name = a["Name"]
        value = a["Value"]
        event.set( "[Request][HeadersFlattened]#{name}", value)
      }
    '
  }

```

Which will get you this if your event is a single JSON object from that array.

```auto
        "HeadersFlattened" => {
                      "accept" => "application/json",
                "content-type" => "multipart/form-data; boundary=----WebKitFormBoundaryBnMGtRJgyfhSDZt3",
                      "cookie" => "GREEDY",
                      "origin" => "https://www.example.net",
                  "user-agent" => "Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36",
               "cache-control" => "no-cache",
            "x-requested-with" => "XMLHttpRequest",
                        "Host" => "www.example.net",
                     "referer" => "https://www.example.net/bla.aspx",
              "Content-Length" => "226245",
             "accept-encoding" => "gzip, deflate, br",
             "accept-language" => "es-ES,es;q=0.8",
                      "x-ajax" => "example"
        },

```

---

_[View the full topic](https://discuss.elastic.co/t/solved-split-filter-question-a-k-a-flatten-json-sub-array/130481)._