# Transforming objects with key and value fields into simple fields

**URL:** https://discuss.elastic.co/t/transforming-objects-with-key-and-value-fields-into-simple-fields/228152
**Category:** Logstash
**Created:** [April 15, 2020, 3:18pm UTC](https://discuss.elastic.co/t/transforming-objects-with-key-and-value-fields-into-simple-fields/228152 "2020-04-15T15:18:14Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![wfhartford](https://avatars.discourse-cdn.com/v4/letter/w/22d042/32.png) [@wfhartford](https://discuss.elastic.co/u/wfhartford)
#### Post date: [April 15, 2020, 3:18pm UTC](https://discuss.elastic.co/t/transforming-objects-with-key-and-value-fields-into-simple-fields/228152/1 "2020-04-15T15:18:14Z")

</div>

Logstash is receiving events which include a list of json objects, each with two fields `key` and `value`:

```auto
    {
      "details": [
        { "key": "foo", "value": "foo value" },
        { "key": "bar", "value": "bar value" },
        { "key": "baz", "value": "baz value" }
      ]
    }

```

I would like to transform this field into a cleaner and more searchable format such as:

```auto
    {
      "details_parsed": {
        "foo": "foo value",
        "bar": "bar value",
        "baz": "baz value"
      }
    }

```

I have not been able to find a logstash filter plugin which will help me very much with this transformation. I'm sure I could use a ruby filter, but would rather use a cleaner solution if one exists.

Thanks for any help

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 15, 2020, 3:40pm UTC](https://discuss.elastic.co/t/transforming-objects-with-key-and-value-fields-into-simple-fields/228152/2 "2020-04-15T15:40:37Z")

</div>

I would do it in a ruby filter. Something like [this](https://discuss.elastic.co/t/logstash-xml-parsing-issues-trying-to-send-to-graylog-part-2/193209/4).

---

<div class="post-metadata">

### Author: ![wfhartford](https://avatars.discourse-cdn.com/v4/letter/w/22d042/32.png) [@wfhartford](https://discuss.elastic.co/u/wfhartford)
#### Post date: [April 15, 2020, 4:00pm UTC](https://discuss.elastic.co/t/transforming-objects-with-key-and-value-fields-into-simple-fields/228152/3 "2020-04-15T16:00:36Z")

</div>

Thanks, it looks like that is the best option.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 13, 2020, 4:15pm UTC](https://discuss.elastic.co/t/transforming-objects-with-key-and-value-fields-into-simple-fields/228152/4 "2020-05-13T16:15:19Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.