# Split array with key+value fields to key: value

**URL:** https://discuss.elastic.co/t/split-array-with-key-value-fields-to-key-value/230506
**Category:** Logstash
**Created:** [April 30, 2020, 9:10am UTC](https://discuss.elastic.co/t/split-array-with-key-value-fields-to-key-value/230506 "2020-04-30T09:10:11Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![Rudolf\_Reddy\_Macejka](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rudolf_reddy_macejka/32/12875_2.png) [@Rudolf\_Reddy\_Macejka](https://discuss.elastic.co/u/Rudolf_Reddy_Macejka)
#### Post date: [April 30, 2020, 9:10am UTC](https://discuss.elastic.co/t/split-array-with-key-value-fields-to-key-value/230506/1 "2020-04-30T09:10:11Z")

</div>

Hello,

I am trying to convert this input

```auto
{    
    "request": {
      "time": "2020-04-30T07:32:13.997Z",
      "size": "0",
      "headers": [
        {
          "key": "Correlation-Id",
          "value": "124f4cdf-6cd7-44ae-a8dc-2ecf2b187f42"
        },
        {
          "key": "host",
          "value": "api.local.host"
        },
        {
          "key": "x-forwarded-for",
          "value": "1.1.1.1"
        },
        {
          "key": "x-forwarded-port",
          "value": "443"
        },
        {
          "key": "x-forwarded-proto",
          "value": "https"
        }
      ],
      "httpMethod": "GET",
      "httpSchema": "https"
  }
}

```

into

```auto
     {    
         "request": {
           "time": "2020-04-30T07:32:13.997Z",
           "size": "0",
           "headers": {
     				"Correlation-Id": "124f4cdf-6cd7-44ae-a8dc-2ecf2b187f42",
     				"host": "api.local.host",
     				"x-forwarded-for": "1.1.1.1",
     				"x-forwarded-port": "443",
     				"x-forwarded-proto": "https"
             },
           "httpMethod": "GET",
           "httpSchema": "https"
       }
     }

```

I have tried to inspirate by [Splitting Array](https://discuss.elastic.co/t/splitting-array/36187/3) and others but using following filter:

```auto
    filter {

     json {
       source => "message"
       remove_field => ["message"]
     }

            ruby {
    		        #code => "event.get('[request][headers]').each {|hash| event.set(hash['key'], hash['value']) }"
    		        code => "event.get('[request][headers]').each {|hash| event.set('[request][headers][' + hash['key'] + ']', hash['value']) }"
            }
    }

```

I am getting this:

```
   "request" => {
       "headers" => [
        [0] {
            "value" => "124f4cdf-6cd7-44ae-a8dc-2ecf2b187f42",
              "key" => "Correlation-Id"
        },
        [1] {
            "value" => "api.local.host",
              "key" => "host"
        },
        [2] {
            "value" => "1.1.1.1",
              "key" => "x-forwarded-for"
        },
        [3] {
            "value" => "443",
              "key" => "x-forwarded-port"
        },
        [4] {
            "value" => "https",
              "key" => "x-forwarded-proto"
        }
    ],

```

Any idea what I am doing wrong?

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 28, 2020, 9:10am UTC](https://discuss.elastic.co/t/split-array-with-key-value-fields-to-key-value/230506/2 "2020-05-28T09:10:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.