# Split array fields in logstash **URL:** \ **Category:** Logstash\ **Created:** [May 4, 2017, 11:43am UTC](https://discuss.elastic.co/t/split-array-fields-in-logstash/84546 "2017-05-04T11:43:24Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![Aditya\_Srivastava](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aditya_srivastava/32/43287_2.png) [@Aditya\_Srivastava](https://discuss.elastic.co/u/Aditya_Srivastava)\ **Post date:** [May 4, 2017, 11:43am UTC](https://discuss.elastic.co/t/split-array-fields-in-logstash/84546/1 "2017-05-04T11:43:24Z")
I have an input where field and value is "id"=["0", "7", "11", "39", "70"] I want to split it and make index as key and split value as value. and then print the index where value is 39. ruby { code =\> " times = event['id'].split(',') times.each\_index { |i| event[i.to\_s] = times[i] if times[i] == "39" event['IndexValue'] = i} " } The below code doesnt work.Can anyone help where my code is going wrong ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [May 4, 2017, 12:47pm UTC](https://discuss.elastic.co/t/split-array-fields-in-logstash/84546/2 "2017-05-04T12:47:23Z")
Which Logstash version? What's the error message in the log? ---
**Author:** ![Aditya\_Srivastava](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aditya_srivastava/32/43287_2.png) [@Aditya\_Srivastava](https://discuss.elastic.co/u/Aditya_Srivastava)\ **Post date:** [May 4, 2017, 1:34pm UTC](https://discuss.elastic.co/t/split-array-fields-in-logstash/84546/3 "2017-05-04T13:34:09Z")
Hi Magnus, Logstash version is 2.1.3 This is the exception which I am getting "tags" =\> [ [0] "\_rubyexception" ], ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [May 4, 2017, 2:09pm UTC](https://discuss.elastic.co/t/split-array-fields-in-logstash/84546/4 "2017-05-04T14:09:32Z")
Look in your Logstash log file. It contains details about the Ruby problem. ---
**Author:** ![Aditya\_Srivastava](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aditya_srivastava/32/43287_2.png) [@Aditya\_Srivastava](https://discuss.elastic.co/u/Aditya_Srivastava)\ **Post date:** [May 9, 2017, 10:11am UTC](https://discuss.elastic.co/t/split-array-fields-in-logstash/84546/5 "2017-05-09T10:11:38Z")
Hi magnus, I am not able too see any logstash config issue. I will try to give more detail about my ques my input is message =\> field id="0" value="01"/\>\n field id="3" value="03"/\>\n \\n field id="7" value="07"/\>\n \\n /isomsg\>\n" I am applying kv filter here kv { source =\> "message" trim =\> """ trimkey =\> """ field\_split =\> " " value\_split =\> "=" } The output I receive is "id" =\> [ [0] "0", [1] "3", [2] "5", [3] "7", [4] "9" ], "value" =\> [ [0] "01", [1] "03", [2] "05", [3] "07", [4] "09" ], Now I want to write a ruby code where I can extract the id and value wrt to index The ruby code should be in loop and check , if id[index] == "7" event['thisvalue'] = value[index] Means first find the index where id is 7(say indexA is 3) and then extract the value at indexA(which should be 07) and store this value as a field. For this the code i wrote is ruby { code =\> " times = event['id'].split(',') times.each\_index { |i| event[i.to\_s] = times[i] if times[i] == "7" event['IndexValue'] = i} " } This code should at-least give me index where the value for "id" is 7 which is not happening and I get ruby fail exception as a tag. "tags" =\> [ [0] "\_rubyexception" ], ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [May 9, 2017, 11:54am UTC](https://discuss.elastic.co/t/split-array-fields-in-logstash/84546/6 "2017-05-09T11:54:39Z")
> I am not able too see any logstash config issue. Look harder. There must be something in the log. ---
**Author:** ![Aditya\_Srivastava](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aditya_srivastava/32/43287_2.png) [@Aditya\_Srivastava](https://discuss.elastic.co/u/Aditya_Srivastava)\ **Post date:** [May 9, 2017, 12:08pm UTC](https://discuss.elastic.co/t/split-array-fields-in-logstash/84546/7 "2017-05-09T12:08:30Z")
Which log are you exactly referring to?? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [May 9, 2017, 12:09pm UTC](https://discuss.elastic.co/t/split-array-fields-in-logstash/84546/8 "2017-05-09T12:09:48Z")
The Logstash log file, typically in /var/log/logstash. If Logstash misbehaves it's the first thing you should check. ---
**Author:** ![Aditya\_Srivastava](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aditya_srivastava/32/43287_2.png) [@Aditya\_Srivastava](https://discuss.elastic.co/u/Aditya_Srivastava)\ **Post date:** [May 9, 2017, 12:14pm UTC](https://discuss.elastic.co/t/split-array-fields-in-logstash/84546/9 "2017-05-09T12:14:37Z")
I have take the logstash zip and unzipped it at a location. I am now running my configuration files from that very location. bin/logstash -f myfile.conf So there is no /var/log/logstash which I have. For that matter, I do not see any log file where logstash is dumping any kind of detail. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [May 9, 2017, 12:29pm UTC](https://discuss.elastic.co/t/split-array-fields-in-logstash/84546/10 "2017-05-09T12:29:07Z")
If you run Logstash like that it should log to your terminal. I suspect the configuration you've posted is different from what your running, because I can spot two errors in your Ruby code that would prevent Logstash from even starting. ---
**Author:** ![Aditya\_Srivastava](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aditya_srivastava/32/43287_2.png) [@Aditya\_Srivastava](https://discuss.elastic.co/u/Aditya_Srivastava)\ **Post date:** [May 9, 2017, 1:38pm UTC](https://discuss.elastic.co/t/split-array-fields-in-logstash/84546/11 "2017-05-09T13:38:53Z")
You are correct. It doesnt work for above ruby code. My logstash config file ran with by commenting few lines. I took reference from below code written by you for some other post > [@Iteration in Logstash](https://discuss.elastic.co/t/iteration-in-logstash/26123): > > I have a string data in Logstash that has been parsed as that looks like "id": "0,3,10" "value": "100,200,300" I would like to match the individual "id" to the corresponding "value" with respect to their order in the string. I want the field to look like "id0": "100" "id3": "200" "id10": "300" As of now, I have used the mutate field to separate the array into its individual values. I used the following code: mutate { add\_field =\> {"id%{[id][0]}" =\> "%{[value][0]}"} add\_field =\> {"id%… filter { ruby { code =\> ' ids = event["id"].split(",") values = event["value"].split(",") if ids.length == values.length ids.each\_index { |i| event["id#{ids[i]}"] = values[i] } end ' } } Could you please tell me what is wrong in the ruby code I wrote or help me with ruby code to solve the prob ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [May 9, 2017, 2:03pm UTC](https://discuss.elastic.co/t/split-array-fields-in-logstash/84546/12 "2017-05-09T14:03:18Z")
There are at least these two problems: - You can't use double quotes in the Ruby code since you're using double quotes as the Ruby code delimiter, i.e. replace `if times[i] == "7"` with `if times[i] == '7'`. - There's an `end` missing at the end of the whole expression. ---
**Author:** ![Aditya\_Srivastava](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aditya_srivastava/32/43287_2.png) [@Aditya\_Srivastava](https://discuss.elastic.co/u/Aditya_Srivastava)\ **Post date:** [May 9, 2017, 2:35pm UTC](https://discuss.elastic.co/t/split-array-fields-in-logstash/84546/13 "2017-05-09T14:35:23Z")
Thanks for pointing out the mistakes. ruby { code =\> " times = event['id'].split(',') times.each\_index { |i| event[i.to\_s] = times[i] if times[i] == '7' event['IndexValue'] = i} end " } Now when I run this, I get foll exception SyntaxError: (ruby filter code):5: syntax error, unexpected tRCURLY event['IndexValue'] = i} ^ eval at org/jruby/RubyKernel.java:1079 register at /data/logstash/vendor/bundle/jruby/1.9/gems/logstash-filter-ruby-2.0.3/lib/logstash/filters/ruby.rb:29 each at org/jruby/RubyArray.java:1613 start\_filters at /data/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.1.3-java/lib/logstash/pipeline.rb:171 run at /data/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.1.3-java/lib/logstash/pipeline.rb:101 execute at /data/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.1.3-java/lib/logstash/agent.rb:165 run at /data/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.1.3-java/lib/logstash/runner.rb:90 call at org/jruby/RubyProc.java:281 run at /data/logstash/vendor/bundle/jruby/1.9/gems/logstash-core-2.1.3-java/lib/logstash/runner.rb:95 call at org/jruby/RubyProc.java:281 initialize at /data/logstash/vendor/bundle/jruby/1.9/gems/stud-0.0.22/lib/stud/task.rb:24 I looked up for the exception, found a solution given by you. > [@Unexpected error in ruby code in logstash](https://discuss.elastic.co/t/unexpected-error-in-ruby-code-in-logstash/70264): > > Hi, An unexpected error in occuring for the following ruby code in logstash filter. SyntaxError: (ruby filter code):5: syntax error, unexpected tRCURLY \*\* }\*\* Following is the ruby code: ruby { code =\> ' allscores = event["score"] if allscores.length != '1' t = allscores.inject(:+) event["total\_score"] = t ' add\_tag =\> [sum\_score] } The error is as follows: SyntaxError: (ruby filter code):5: syntax error, unexpected tRCURLY } ^ eval at org/jruby/RubyKernel.java:1… ruby { code =\> " times = event["id"].split(',') times.each\_index { |i| event[i.to\_s] = times[i] if times[i] == '7' event['IndexValue.to\_i'] = i} end " } when change event['id'] from single quote to double quotes as mentioned above, it gives me foll exception Error: Expected one of #, {, } at line 25, column 16 (byte 545) If I comment out the complete ruby code, It works fine. Means again there is some prob with the ruby code. Plz refer some link as well where I can study more detail on how to use ruby in logstash. ---
**Author:** ![Nico-DF](https://avatars.discourse-cdn.com/v4/letter/n/ed8c4c/32.png) [@Nico-DF](https://discuss.elastic.co/u/Nico-DF)\ **Post date:** [May 9, 2017, 2:40pm UTC](https://discuss.elastic.co/t/split-array-fields-in-logstash/84546/14 "2017-05-09T14:40:20Z")
> [@Aditya\_Srivastava](#): > > ruby { > code =\> " > times = event['id'].split(',') > times.each\_index { |i| event[i.to\_s] = times[i] > if times[i] == '7' > event['IndexValue'] = i} > end > " > } There's a problem here: ```auto times.each_index { |i| event[i.to_s] = times[i] if times[i] == '7' event['IndexValue'] = i} end ``` Try: ```auto times.each_index { |i| event[i.to_s] = times[i] if times[i] == '7' event['IndexValue'] = i end } ``` Or close your brace before (I don't know what you're trying to do) ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [May 9, 2017, 2:41pm UTC](https://discuss.elastic.co/t/split-array-fields-in-logstash/84546/15 "2017-05-09T14:41:50Z")
Replace ```plaintext if times[i] == '7' event['IndexValue'] = i} end ``` with ```plaintext if times[i] == '7' event['IndexValue'] = i end } ``` > Plz refer some link as well where I can study more detail on how to use ruby in logstash. Apart from the ruby filter documentation there isn't much available that applies without reservations to Logstash 2.1. ---
**Author:** ![Aditya\_Srivastava](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aditya_srivastava/32/43287_2.png) [@Aditya\_Srivastava](https://discuss.elastic.co/u/Aditya_Srivastava)\ **Post date:** [May 9, 2017, 2:46pm UTC](https://discuss.elastic.co/t/split-array-fields-in-logstash/84546/16 "2017-05-09T14:46:38Z")
Yes. The solution works and the config file runs properly But still receiving "tags" =\> [ [0] "\_rubyexception" Also this message gets logged on console in red color Ruby exception occurred: undefined method `split' for nil:NilClass {:level=>:error} Ruby exception occurred: undefined method`split' for ["0", "3", "5", "7", "9"]:Array {:level=\>:error} ---
**Author:** ![Aditya\_Srivastava](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aditya_srivastava/32/43287_2.png) [@Aditya\_Srivastava](https://discuss.elastic.co/u/Aditya_Srivastava)\ **Post date:** [May 9, 2017, 2:48pm UTC](https://discuss.elastic.co/t/split-array-fields-in-logstash/84546/17 "2017-05-09T14:48:41Z")
> [@Nico-DF](#): > > Or close your brace before (I don't know what you're trying to do) If possible request you to start fresh as this is getting messy. I will try and frame my query in more clear and structured way now ---
**Author:** ![Aditya\_Srivastava](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aditya_srivastava/32/43287_2.png) [@Aditya\_Srivastava](https://discuss.elastic.co/u/Aditya_Srivastava)\ **Post date:** [May 9, 2017, 2:52pm UTC](https://discuss.elastic.co/t/split-array-fields-in-logstash/84546/18 "2017-05-09T14:52:43Z")
> [@Aditya\_Srivastava](#): > > "id" =\> [ > [0] "0", > [1] "3", > [2] "5", > [3] "7", > [4] "9" > ], Is this in array format? Can I apply split function on this event. I feel somehow the ruby exception is because of this array that I am trying to split Please confirm ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [May 9, 2017, 3:00pm UTC](https://discuss.elastic.co/t/split-array-fields-in-logstash/84546/19 "2017-05-09T15:00:32Z")
> Ruby exception occurred: undefined method split' for nil:NilClass {:level=\>:error} That error indicates that not all your events have an `id` field. `event['id']` evaluates to nil when the field doesn't exist. > Ruby exception occurred: undefined methodsplit' for ["0", "3", "5", "7", "9"]:Array {:level=\>:error} You can split strings but not arrays. Arrays don't need to be split. ---
**Author:** ![Aditya\_Srivastava](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aditya_srivastava/32/43287_2.png) [@Aditya\_Srivastava](https://discuss.elastic.co/u/Aditya_Srivastava)\ **Post date:** [May 10, 2017, 7:11am UTC](https://discuss.elastic.co/t/split-array-fields-in-logstash/84546/20 "2017-05-10T07:11:40Z")
> [@magnusbaeck](#): > > You can split strings but not arrays. Arrays don't need to be split. What should I do then if I want to find the index of "7" in given array?? [Next page](https://discuss.elastic.co/t/split-array-fields-in-logstash/84546.md?page=2)