# Use file values as variable or iterate over values

**URL:** <https://discuss.elastic.co/t/use-file-values-as-variable-or-iterate-over-values/304947>\
**Category:** Logstash\
**Created:** [May 17, 2022, 1:18pm UTC](https://discuss.elastic.co/t/use-file-values-as-variable-or-iterate-over-values/304947 "2022-05-17T13:18:41Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![S-elk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/s-elk/32/98464_2.png) [@S-elk](https://discuss.elastic.co/u/S-elk)\
**Post date:** [May 17, 2022, 1:18pm UTC](https://discuss.elastic.co/t/use-file-values-as-variable-or-iterate-over-values/304947/1 "2022-05-17T13:18:41Z")

</div>

Hello!

Right now I have a pipeline that creates a field using a ruby scanner. When this scanner detects one of the values entered in the regular expression, it creates a field with that value.

For example:

```auto
if [x] {
    ruby {
      code => "event.set(y', event.get('[scanner]').scan(/\bvalue1\b|\bvalue2|\bvalueN/))"
}

```

is there any way to replace all this regular expression by a file or iterate over an array?

for example:

```auto
if [x] {
    ruby {
      code => "event.set(y', event.get('[scanner]').scan(/\b${iterate_over_values_of_array_in_file}\b/))"
}

```

Currently we already have more than 30 values and we will continue adding more and we would like this to be as dynamic as possible.

I don't know if the prune filter can solve this somehow.

any suggestions would be of great help.  
Thank you

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 17, 2022, 3:42pm UTC](https://discuss.elastic.co/t/use-file-values-as-variable-or-iterate-over-values/304947/2 "2022-05-17T15:42:22Z")

</div>

I think you would have to do it in ruby. You could read the regexp from a file when the pipeline starts up (i.e. in the init section of a ruby filter). You could event re-purpose code from the [translate](https://github.com/logstash-plugins/logstash-filter-translate/tree/main/lib/logstash/filters/dictionary) filter to periodically check if the file has been updated and reload it.

You could store the finished regexp in the file, or have one alternation per line and join them all up in the filter. It is just a question of how much ruby code you want to write.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 14, 2022, 3:42pm UTC](https://discuss.elastic.co/t/use-file-values-as-variable-or-iterate-over-values/304947/3 "2022-06-14T15:42:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.