# Splitting a json array format with same fields name

**URL:** https://discuss.elastic.co/t/splitting-a-json-array-format-with-same-fields-name/318509
**Category:** Logstash
**Created:** [November 9, 2022, 6:32am UTC](https://discuss.elastic.co/t/splitting-a-json-array-format-with-same-fields-name/318509 "2022-11-09T06:32:22Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![Adabi\_Raihan](https://avatars.discourse-cdn.com/v4/letter/a/67e7ee/32.png) [@Adabi\_Raihan](https://discuss.elastic.co/u/Adabi_Raihan)
#### Post date: [November 9, 2022, 6:32am UTC](https://discuss.elastic.co/t/splitting-a-json-array-format-with-same-fields-name/318509/1 "2022-11-09T06:32:22Z")

</div>

Hi Everyone,

Currently, i have this kind of JSON array with the same field, what I wanted is to split this data into an independent field and the field name is based on a "name" field

events.parameters (this is the field name of JSON array)

> {  
> "name": "USER\_EMAIL",  
> "value": "[dummy@yahoo.com](mailto:dummy@yahoo.com)"  
> },  
> {  
> "name": "DEVICE\_ID",  
> "value": "Wdk39Iw-akOsiwkaALw"  
> },  
> {  
> "name": "SERIAL\_NUMBER",  
> "value": "9KJUIHG"  
> }

expected output:

events.parameters.USER\_EMAIL : [dummy@yahoo.com](mailto:dummy@yahoo.com)  
events.parameters.DEVICE\_ID: Wdk39Iw-akOsiwkaALw  
events.parameters.SERIAL\_NUMBER : 9KJUIHG

Thanks.

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [November 9, 2022, 4:13pm UTC](https://discuss.elastic.co/t/splitting-a-json-array-format-with-same-fields-name/318509/2 "2022-11-09T16:13:35Z")

</div>

You will want something like [this](https://discuss.elastic.co/t/solved-split-filter-question-a-k-a-flatten-json-sub-array/130481/12).

---

<div class="post-metadata">

### Author: ![Adabi\_Raihan](https://avatars.discourse-cdn.com/v4/letter/a/67e7ee/32.png) [@Adabi\_Raihan](https://discuss.elastic.co/u/Adabi_Raihan)
#### Post date: [November 10, 2022, 6:15am UTC](https://discuss.elastic.co/t/splitting-a-json-array-format-with-same-fields-name/318509/3 "2022-11-10T06:15:46Z")

</div>

it gives me this error

> [ERROR][logstash.filters.ruby] Ruby exception occurred: Invalid FieldReference: `[events][parameters_split]USER_EMAIL`

any idea ?

this I what I wrote

```auto
> if [events][parameters] {
> ruby {
> code => '
> event.get("[events][parameters]").each { |a|
> name = a["name"]
> value = a["value"]
> event.set( "[events][parameters_split]#{name}", value)
> }
> '
> }
> }

```

---

<div class="post-metadata">

### Author: ![Adabi\_Raihan](https://avatars.discourse-cdn.com/v4/letter/a/67e7ee/32.png) [@Adabi\_Raihan](https://discuss.elastic.co/u/Adabi_Raihan)
#### Post date: [November 10, 2022, 7:44am UTC](https://discuss.elastic.co/t/splitting-a-json-array-format-with-same-fields-name/318509/4 "2022-11-10T07:44:06Z")

</div>

nevermind, find the issue just give **[** **]** to #{name}

final:

```auto
   if [events][parameters] {
      ruby {
        code => '
          event.get("[events][parameters]").each { |a|
            name = a["name"]
            value = a["value"]
            event.set("[events][parameters_split][#{name}]", value)
          }
        '
      }
    }

```

Thanks Badger !

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 8, 2022, 7:44am UTC](https://discuss.elastic.co/t/splitting-a-json-array-format-with-same-fields-name/318509/5 "2022-12-08T07:44:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.