# Transform array objects in fields

**URL:** <https://discuss.elastic.co/t/transform-array-objects-in-fields/121269>\
**Category:** Logstash\
**Created:** [February 23, 2018, 6:45pm UTC](https://discuss.elastic.co/t/transform-array-objects-in-fields/121269 "2018-02-23T18:45:58Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Leonardo\_Santana](https://avatars.discourse-cdn.com/v4/letter/l/e8c25b/32.png) [@Leonardo\_Santana](https://discuss.elastic.co/u/Leonardo_Santana)\
**Post date:** [February 23, 2018, 6:45pm UTC](https://discuss.elastic.co/t/transform-array-objects-in-fields/121269/1 "2018-02-23T18:45:58Z")

</div>

hi,

I have a object like this:

"fields": [  
{  
"value": "123",  
"id": "0"  
},  
{  
"value": "456",  
"id": "1"  
},  
{  
"value": "llllobj",  
"id": "2"  
}  
]

but i want change the id to a field in my object like this:  
"fields": {  
"0": "123",  
"1": "456",  
"2": "llllobj"  
}  
it´s possible? What is the most appropriate filter for this?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 26, 2018, 12:08pm UTC](https://discuss.elastic.co/t/transform-array-objects-in-fields/121269/2 "2018-02-26T12:08:05Z")

</div>

None of the standard filters can do exactly this but you can write some code in a ruby filter. This should be close to what you want:

```nohighlight
event.get('fields').each { |kvpair|
  event.set(kvpair['id'], kvpair['value'])
}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 26, 2018, 12:08pm UTC](https://discuss.elastic.co/t/transform-array-objects-in-fields/121269/3 "2018-03-26T12:08:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.