# Split array with key+value fields to key: value - Follow up
**URL:** https://discuss.elastic.co/t/split-array-with-key-value-fields-to-key-value-follow-up/240469
**Category:** Logstash
**Created:** [July 9, 2020, 7:30am UTC](https://discuss.elastic.co/t/split-array-with-key-value-fields-to-key-value-follow-up/240469 "2020-07-09T07:30:55Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@Rudolf\_Reddy\_Macejka](https://discuss.elastic.co/u/Rudolf_Reddy_Macejka)
#### Post date: [July 9, 2020, 7:30am UTC](https://discuss.elastic.co/t/split-array-with-key-value-fields-to-key-value-follow-up/240469/1 "2020-07-09T07:30:56Z")
Hello,
I am trying to convert this input
```auto
{
"request": {
"time": "2020-04-30T07:32:13.997Z",
"size": "0",
"headers": [
{
"key": "Correlation-Id",
"value": "124f4cdf-6cd7-44ae-a8dc-2ecf2b187f42"
},
{
"key": "host",
"value": "api.local.host"
},
{
"key": "x-forwarded-for",
"value": "1.1.1.1"
},
{
"key": "x-forwarded-port",
"value": "443"
},
{
"key": "x-forwarded-proto",
"value": "https"
}
],
"httpMethod": "GET",
"httpSchema": "https"
}
}
```
into
```auto
{
"request": {
"time": "2020-04-30T07:32:13.997Z",
"size": "0",
"headers": {
"Correlation-Id": "124f4cdf-6cd7-44ae-a8dc-2ecf2b187f42",
"host": "api.local.host",
"x-forwarded-for": "1.1.1.1",
"x-forwarded-port": "443",
"x-forwarded-proto": "https"
},
"httpMethod": "GET",
"httpSchema": "https"
}
}
```
I have tried to inspirate by [Splitting Array](https://discuss.elastic.co/t/splitting-array/36187/3) and others but using following filter:
```auto
filter {
json {
source => "message"
remove_field => ["message"]
}
ruby {
#code => "event.get('[request][headers]').each {|hash| event.set(hash['key'], hash['value']) }"
code => "event.get('[request][headers]').each {|hash| event.set('[request][headers][' + hash['key'] + ']', hash['value']) }"
}
}
```
I am getting this:
```auto
"request" => {
"headers" => [
[0] {
"value" => "124f4cdf-6cd7-44ae-a8dc-2ecf2b187f42",
"key" => "Correlation-Id"
},
[1] {
"value" => "api.local.host",
"key" => "host"
},
[2] {
"value" => "1.1.1.1",
"key" => "x-forwarded-for"
},
[3] {
"value" => "443",
"key" => "x-forwarded-port"
},
[4] {
"value" => "https",
"key" => "x-forwarded-proto"
}
],
```
Any idea what I am doing wrong?
---
### Author:  [@Jenni](https://discuss.elastic.co/u/Jenni)
#### Post date: [July 9, 2020, 9:06am UTC](https://discuss.elastic.co/t/split-array-with-key-value-fields-to-key-value-follow-up/240469/2 "2020-07-09T09:06:11Z")
headers is an array, but you are treating it like a hash. That's probably causing an error. Try to save the data in a new field first and then exchange the old field for the new one afterwards.
```
ruby {
code => "
event.get('[request][headers]').each do |item|
event.set('[headers_transformed]['+item['key']+']', item['value'])
end
"
}
mutate {
rename => { "headers_transformed" => "[request][headers]" }
}
```
---
### Author:  [@Rudolf\_Reddy\_Macejka](https://discuss.elastic.co/u/Rudolf_Reddy_Macejka)
#### Post date: [July 20, 2020, 9:28am UTC](https://discuss.elastic.co/t/split-array-with-key-value-fields-to-key-value-follow-up/240469/3 "2020-07-20T09:28:47Z")
> [@Jenni](#):
>
> ```auto
> mutate {
> rename => { "headers_transformed" => "[request][headers]" }
> }
>
> ```
Thank you so much Jenni!
It works perfectly!
Thank you again!
Reddy
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 17, 2020, 9:28am UTC](https://discuss.elastic.co/t/split-array-with-key-value-fields-to-key-value-follow-up/240469/4 "2020-08-17T09:28:50Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.