# Storing value and attaching it later

**URL:** https://discuss.elastic.co/t/storing-value-and-attaching-it-later/267892
**Category:** Logstash
**Created:** [March 20, 2021, 7:44pm UTC](https://discuss.elastic.co/t/storing-value-and-attaching-it-later/267892 "2021-03-20T19:44:45Z")
**Posts on this page:** 1
**Showing post:** 3

<div class="post-metadata">

### Author: ![thaideval](https://avatars.discourse-cdn.com/v4/letter/t/a8b319/32.png) [@thaideval](https://discuss.elastic.co/u/thaideval)
#### Post date: [March 21, 2021, 4:10pm UTC](https://discuss.elastic.co/t/storing-value-and-attaching-it-later/267892/3 "2021-03-21T16:10:14Z")

</div>

So i got it :  
With ruby filters i am scanning event and getting ID,name and level into an array, then i merge them with .zip api (big props to Magnus Baeck - [here](https://discuss.elastic.co/t/how-to-concatenate-contents-of-two-string-arrays-with-same-number-of-elements/256) )

That was so easy - i decided to add one more field (level). 🙂

> **Summary**
>
> ```
> ruby { code => "event.set('ID', event.get('message').scan(/(?<=ID:\s)\d+/) )" }
> ruby { code => "event.set('name', event.get('message').scan(/[^;]+(?=;ID)/) )" }
> ruby { code => "event.set('level', event.get('message').scan(/[^;]+(?=;[^;]*;ID)/) )" }
> ruby { code => "event.set('Results', event.get('ID').zip(event.get('name'),event.get('level')).map! { |item| item[0] +'; '+ item[1] +'; '+ item[2] +';' } )" }
> 
> ```

After ruby i just use split plugin for field "Results"

> **Summary**
>
> split {  
> field =\> "Results"  
> remove\_field =\> ["ID", "name", "level"]  
> }

Logstash is amazing!

---

_[View the full topic](https://discuss.elastic.co/t/storing-value-and-attaching-it-later/267892)._