### Author:  [@Khaled](https://discuss.elastic.co/u/Khaled)
#### Post date: [June 25, 2017, 1:17am UTC](https://discuss.elastic.co/t/split-arrays-of-keys-and-values/90736/1 "2017-06-25T01:17:31Z")
I'm using Amazon SQS input plugin to get bounced & delivery reports from Amazon SES (Simple Email Service).
One of the fields (_mail.headers_) is an array of keys and values, like the following:
```
{
"name": "Message-ID",
"value": "<08c903bee6de5daa173f5856a@swift.generated>"
},
{
"name": "Date",
"value": "Sat, 24 Jun 2017 22:53:33 +0200"
},
{
"name": "Subject",
"value": "Welcome to our website"
},
{
"name": "From",
"value": "Example "
},
{
"name": "To",
"value": "email@someone.com"
}
```
I want to split those fields to be something like
```
headers.Message-ID: <08c903bee6de5daa173f5856a@swift.generated>
headers.Date: Sat, 24 Jun 2017 22:53:33 +0200
headers.Subject: Welcome to our website
...
```
I have tried doing the following, but unfortunately, it didn't work as expected and returned only one array ignored the rest:
```
split {
add_field => { "headers[%{[mail][headers][name]}]" => "%{[mail][headers][value]}" }
field => "[mail][headers]"
}
```
So, how can I achieve this?
---
### Author:  [@thiago](https://discuss.elastic.co/u/thiago)
#### Post date: [June 25, 2017, 4:25am UTC](https://discuss.elastic.co/t/split-arrays-of-keys-and-values/90736/2 "2017-06-25T04:25:49Z")
The split filter splits multi-line messages into distinct events and it doesn't seems to be what you want to do.
I don't think there is a proper plugin for doing that. You may need to use the ruby plugin with custom code.
---
### Author:  [@Khaled](https://discuss.elastic.co/u/Khaled)
#### Post date: [June 25, 2017, 6:41pm UTC](https://discuss.elastic.co/t/split-arrays-of-keys-and-values/90736/3 "2017-06-25T18:41:39Z")
I was able to split the arrays into key =\> value using `Ruby` filter like you said, but unfortunately, what I did moved the events to the top level and I want it to be under `headers` property
```
filter {
if [mail][headers] {
ruby {
code => "event.get('[mail][headers]').each {|hash| event.set(hash['name'], hash['value']) }"
}
}
}
```
Output:
```
{
"Message-ID": "Blah Blah Blah",
"X-Priority": "2 (High)"
}
```
Expected:
```
{
"headers": {
"Message-ID": "Blah Blah Blah",
"X-Priority": "2 (High)"
}
}
```
Sorry If my question is trivial, but I'm a Ruby developer.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [June 26, 2017, 5:58am UTC](https://discuss.elastic.co/t/split-arrays-of-keys-and-values/90736/4 "2017-06-26T05:58:31Z")
Try replacing
```
event.set(hash['name'], hash['value'])
```
with
```
event.set('[headers][' + hash['name'] + ']', hash['value'])
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 24, 2017, 5:58am UTC](https://discuss.elastic.co/t/split-arrays-of-keys-and-values/90736/5 "2017-07-24T05:58:39Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.