# Trying to get values in array

**URL:** <https://discuss.elastic.co/t/trying-to-get-values-in-array/133736>\
**Category:** Logstash\
**Created:** [May 29, 2018, 6:25pm UTC](https://discuss.elastic.co/t/trying-to-get-values-in-array/133736 "2018-05-29T18:25:48Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Shivom\_Kumar](https://avatars.discourse-cdn.com/v4/letter/s/cdc98d/32.png) [@Shivom\_Kumar](https://discuss.elastic.co/u/Shivom_Kumar)\
**Post date:** [May 29, 2018, 6:25pm UTC](https://discuss.elastic.co/t/trying-to-get-values-in-array/133736/1 "2018-05-29T18:25:48Z")

</div>

hi . i was doing something similar to getting values as an array. i have my log something like this  
fab 20 gds 30 rt 21  
i want to create two array : one contating {fab,dgs,rt} and other containing their respective value {20,30,,21}  
i followed the approach similar to this: #35  
this is how i wrote my rules +1  
CUSTOM\_VALUE (?:%{NUMBER})  
CUSTOM\_LIST\_VALUE (?:(\s\*%{WORD}[\s\*]%{CUSTOM\_VALUE}))  
CUSTOM\_VALUE\_LIST\_COMPLEX (?:(%{CUSTOM\_LIST\_VALUE})+)

and i am matching %{CUSTOM\_VALUE\_LIST\_COMPLEX:category}  
i am getting whole fab 20 gds 30 rt 21 under CUSTOM\_VALUE\_LIST\_COMPLEX.  
my question is how to get those values like array as i mentioned above from this CUSTOM\_VALUE\_LIST\_COMPLEX

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 29, 2018, 6:40pm UTC](https://discuss.elastic.co/t/trying-to-get-values-in-array/133736/2 "2018-05-29T18:40:50Z")

</div>

I would do that in a ruby filter

```auto
    ruby {
        code => '
            i = 1
            out1 = []
            out2 = []

            a = event.get("message").split(" ").each { |v|
                i = i+1
                if i % 2 == 0
                    out1 << v
                else
                    out2 << v
                end
            }
            event.set("out1", out1)
            event.set("out2", out2)
        '

```

---

<div class="post-metadata">

**Author:** ![Shivom\_Kumar](https://avatars.discourse-cdn.com/v4/letter/s/cdc98d/32.png) [@Shivom\_Kumar](https://discuss.elastic.co/u/Shivom_Kumar)\
**Post date:** [May 30, 2018, 8:52am UTC](https://discuss.elastic.co/t/trying-to-get-values-in-array/133736/3 "2018-05-30T08:52:02Z")

</div>

thanks @Badger . its working . but is there any way to do this with the help of grok filter ?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 30, 2018, 12:46pm UTC](https://discuss.elastic.co/t/trying-to-get-values-in-array/133736/4 "2018-05-30T12:46:30Z")

</div>

Yes, but it feels unnatural to me.

```
grok { match => ["message", "%{WORD:foo} %{WORD:bar} %{WORD:foo} %{WORD:bar} %{WORD:foo} %{WORD:bar}"] }
```

---

<div class="post-metadata">

**Author:** ![Shivom\_Kumar](https://avatars.discourse-cdn.com/v4/letter/s/cdc98d/32.png) [@Shivom\_Kumar](https://discuss.elastic.co/u/Shivom_Kumar)\
**Post date:** [May 30, 2018, 7:43pm UTC](https://discuss.elastic.co/t/trying-to-get-values-in-array/133736/5 "2018-05-30T19:43:54Z")

</div>

@Badger  
ok so i will post here my complete problem .

i have my logs something like this :

May 18 2018 06:51:03 GMT: INFO (info): (ticker.c:313) fds: proto (0,6,6) heartbeat (1,3,2) fabric (15,24,9)  
May 18 2018 06:47:42 GMT: INFO (namespace): (namespace\_ce.c:96) {test} gd 10 prole 20  
May 18 2018 06:47:52 GMT: INFO (info): (ticker.c:408) {bar} objects: all 0 master 0 prole 0 non-replica 0

in the above lines (namespace\_ce.c) and (ticker.c) are the filenames.  
the code that u wrote as a ruby filter i used that to get the arrays as for ex out1 =\>{proto,heartbeat,fabric} and their respective value out2 =\>{(0,6,6),(1,3,2),(15,24,9)}

now i have some problems. firstly the rules that i wrote parse both the filenames logs. but i want to parse only those logs that have filename as ticker.c  
so i wrote rule for that . below is what i wrote

grok {  
patterns\_dir =\> ["/etc/logstash/patterns"]  
match =\> {"message" =\> "%{GREEDYDATA:before} (%{FILENAME:filename}:%{NUMBER:file\_no}) %{GREEDYDATA:left\_message}"}  
}  
if ([filename] == "ticker.c") {  
#QUE 1 :here i want to write code to match the left\_message obtained from above with some regex . can it be done ?  
}  
}  
else {  
drop {}  
}  
}

#QUE2 : if i am using the above technique then logstash parse only one line. how can i get it to parse all lines in my log file ?

---

<div class="post-metadata">

**Author:** ![Shivom\_Kumar](https://avatars.discourse-cdn.com/v4/letter/s/cdc98d/32.png) [@Shivom\_Kumar](https://discuss.elastic.co/u/Shivom_Kumar)\
**Post date:** [May 31, 2018, 9:10am UTC](https://discuss.elastic.co/t/trying-to-get-values-in-array/133736/6 "2018-05-31T09:10:06Z")

</div>

@Badger  
also is there a way to do the map kind of thing instead of having two arrays.  
like a single map having key and value kind of thing. in ruby ?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 28, 2018, 9:10am UTC](https://discuss.elastic.co/t/trying-to-get-values-in-array/133736/7 "2018-06-28T09:10:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.