# Split Nested Object
**URL:** https://discuss.elastic.co/t/split-nested-object/104911
**Category:** Logstash
**Created:** [October 23, 2017, 2:24pm UTC](https://discuss.elastic.co/t/split-nested-object/104911 "2017-10-23T14:24:37Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@filipe.ferreira](https://discuss.elastic.co/u/filipe.ferreira)
#### Post date: [October 23, 2017, 2:24pm UTC](https://discuss.elastic.co/t/split-nested-object/104911/1 "2017-10-23T14:24:37Z")
I have a json log that looks like this:
{
"a" : "info",
"data" : {
"x1" : { Object },
"x2" : { Object },
"x3" : { Object }
}
}
I would like to convert it to look like this:
{
"a" : "info",
"data" : {
"x1" : { Object },
}
}
{
"a" : "info",
"data" : {
"x2" : { Object },
}
}
{
"a" : "info",
"data" : {
"x3" : { Object }
}
}
If it was an array I could do it with split, but it isn't. Can I convert it to an array and then split it ? Or there is another way to do it ?
Best Regards,
Filipe Ferreira.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [October 23, 2017, 3:09pm UTC](https://discuss.elastic.co/t/split-nested-object/104911/2 "2017-10-23T15:09:38Z")
You could use a ruby filter to transform
```nohighlight
"data" : {
"x1" : { Object },
"x2" : { Object },
"x3" : { Object }
}
```
into something like
```nohighlight
"data" : [
["x1", { Object }],
["x2", { Object }],
["x3", { Object }]
]
```
which would then be splittable (and then you'd need another ruby filter to get un-array the values).
---
### Author:  [@filipe.ferreira](https://discuss.elastic.co/u/filipe.ferreira)
#### Post date: [November 3, 2017, 4:54pm UTC](https://discuss.elastic.co/t/split-nested-object/104911/3 "2017-11-03T16:54:03Z")
Hi Magnus Back,
I was able to transform it with ruby filter and with help with event.get and event.set. With event.get, I got only the data block only and with a cycle, I got x1, x2, x3 and pushed them into an array. Finally, with event.set, I put the resulting array on the msg.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 1, 2017, 4:54pm UTC](https://discuss.elastic.co/t/split-nested-object/104911/4 "2017-12-01T16:54:12Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.