# Split array without generating new event

**URL:** <https://discuss.elastic.co/t/split-array-without-generating-new-event/73097>\
**Category:** Logstash\
**Created:** [January 28, 2017, 6:23pm UTC](https://discuss.elastic.co/t/split-array-without-generating-new-event/73097 "2017-01-28T18:23:26Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![paketecuento](https://avatars.discourse-cdn.com/v4/letter/p/e480ec/32.png) [@paketecuento](https://discuss.elastic.co/u/paketecuento)\
**Post date:** [January 28, 2017, 6:23pm UTC](https://discuss.elastic.co/t/split-array-without-generating-new-event/73097/1 "2017-01-28T18:23:26Z")

</div>

Hi,  
I'm trying to parse some JSON from scopus database. I'm almost done using mutate and split plugins, but I'm unable to get a final step. Using `json` plugin and `rubydebug` output, I get: :

```
{
"search-results": {
  "author" => [
    [0] {
              "@_fa" => "true",
              "@seq" => "1",
        "author-url" => "http://api.elsevier.com/content/author/author_id/7201973766",
            "authid" => "7201973766",
          "authname" => "Hughes B.",
           "surname" => "Hughes",
        "given-name" => "Brent M.",
          "initials" => "B.M.",
              "afid" => [
            [0] {
                "@_fa" => "true",
                   "$" => "60025262"
            }
        ]
    },
    [1] {
              "@_fa" => "true",
              "@seq" => "2",
        "author-url" => "http://api.elsevier.com/content/author/author_id/26660462900",
            "authid" => "26660462900",
          "authname" => "Chan J.",
           "surname" => "Chan",
        "given-name" => "John S.",
          "initials" => "J.S.",
              "afid" => [
            [0] {
                "@_fa" => "true",
                   "$" => "60025262"
            }
        ]
    },
    [2] {
              "@_fa" => "true",
              "@seq" => "3",
        "author-url" => "http://api.elsevier.com/content/author/author_id/7005693830",
            "authid" => "7005693830",
          "authname" => "Koval D.",
           "surname" => "Koval",
        "given-name" => "Don O.",
          "initials" => "D.O.",
              "afid" => [
            [0] {
                "@_fa" => "true",
                   "$" => "60025262"
            }
        ]
    }
 ]
}

```

And I would like to get something like:

```
{
"search-results": {
  "author0" => {
              "@_fa" => "true",
              "@seq" => "1",
        "author-url" => "http://api.elsevier.com/content/author/author_id/7201973766",
            "authid" => "7201973766",
          "authname" => "Hughes B.",
           "surname" => "Hughes",
        "given-name" => "Brent M.",
          "initials" => "B.M.",
              "afid" => [
            [0] {
                "@_fa" => "true",
                   "$" => "60025262"
            }
        ]
    },
    "author1" => {
              "@_fa" => "true",
              "@seq" => "2",
        "author-url" => "http://api.elsevier.com/content/author/author_id/26660462900",
            "authid" => "26660462900",
          "authname" => "Chan J.",
           "surname" => "Chan",
        "given-name" => "John S.",
          "initials" => "J.S.",
              "afid" => [
            [0] {
                "@_fa" => "true",
                   "$" => "60025262"
            }
        ]
    },
    "author2" => {
              "@_fa" => "true",
              "@seq" => "3",
        "author-url" => "http://api.elsevier.com/content/author/author_id/7005693830",
            "authid" => "7005693830",
          "authname" => "Koval D.",
           "surname" => "Koval",
        "given-name" => "Don O.",
          "initials" => "D.O.",
              "afid" => [
            [0] {
                "@_fa" => "true",
                   "$" => "60025262"
            }
        ]
    }
}

```

I'd been playing with some `ruby` code, but without success.  
Briefly, I'd like to convert each array entry in an object, without splitting them in different events.

thank you.

**UPDATE:** I tried [https://discuss.elastic.co/t/parse-split-nested-single-json-array-in-logstash/72059](https://discuss.elastic.co/t/parse-split-nested-single-json-array-in-logstash/72059) without success

```
 ruby {
   code => '
           event.get("[search-results][title]").each { |i|
           event.set("search-results_Title_#{i+1}", i.to_i)
           }
   '
 }
```

---

<div class="post-metadata">

**Author:** ![paketecuento](https://avatars.discourse-cdn.com/v4/letter/p/e480ec/32.png) [@paketecuento](https://discuss.elastic.co/u/paketecuento)\
**Post date:** [January 28, 2017, 8:46pm UTC](https://discuss.elastic.co/t/split-array-without-generating-new-event/73097/2 "2017-01-28T20:46:13Z")

</div>

I reply myself:

```
	ruby {
  code => '
    event["[search-results][title]"].each_index { |i|
    	event["[search-results][title#{i}]"] = event["[search-results][title][#{i}]"]
    }
  '
}

```

So, now is solved. Maybe this post could be useful to others.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 25, 2017, 8:46pm UTC](https://discuss.elastic.co/t/split-array-without-generating-new-event/73097/3 "2017-02-25T20:46:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.