# Using field value as value in message\[x\]

**URL:** <https://discuss.elastic.co/t/using-field-value-as-value-in-message-x/305035>\
**Category:** Logstash\
**Created:** [May 18, 2022, 8:48am UTC](https://discuss.elastic.co/t/using-field-value-as-value-in-message-x/305035 "2022-05-18T08:48:11Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![alex\_vermex](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alex_vermex/32/101267_2.png) [@alex\_vermex](https://discuss.elastic.co/u/alex_vermex)\
**Post date:** [May 18, 2022, 8:48am UTC](https://discuss.elastic.co/t/using-field-value-as-value-in-message-x/305035/1 "2022-05-18T08:48:11Z")

</div>

Hi,  
I would like to ask that i have field` x => 0` it was an integer field value and i have a `message[]` array i want to consume the value of x inside the message for example: `message[x]` .  
here is an example of my code:

```auto
filter {
mutate { split => {"message" => "|"} }
ruby {
      code => "event.set('x', 0)"
      }
mutate {
      add_field => { "test_x" => "%{x}" }
      add_field => { "DateTime" => "%{[message][%{x}]}" }
}
      ruby {
      code => "event.set('x', (event.get('x')) + 1)"
      }
mutate {
      add_field => { "GateWay" => "%{[message][2]}" }
}
}

```

add\_field always adds strings ok but i want to use a integer value inside message `%{[message][%{x}]}` did not work

```auto
Exception caught while applying mutate filter {:exception=>"Invalid FieldReference: `[message][%{x`"}

```

Also i tried to add this fied in ruby filter like this :

```auto
ruby {
      code => "event.set('x', (event.get('x')) + 1)
               event.set('field_name', event.get('[message][event.get('x')]'))
              "
      }

```

I did not find what to enter in this box `event.get('[message][event.get('x')]')`

Any help would be sincerely appreciate!  
Thanks!

---

<div class="post-metadata">

**Author:** ![Tomo\_M](https://avatars.discourse-cdn.com/v4/letter/t/848f3c/32.png) [@Tomo\_M](https://discuss.elastic.co/u/Tomo_M)\
**Post date:** [May 18, 2022, 10:56am UTC](https://discuss.elastic.co/t/using-field-value-as-value-in-message-x/305035/2 "2022-05-18T10:56:22Z")

</div>

> [@alex\_vermex](#):
>
> event.get('[message][event.get('x')]')

`event.get('x')` is just string and does not work as you expect.

How about this?

```auto
ruby {
      code => "event.set('x', (event.get('x')) + 1)
               event.set('field_name', event.get('[message][' + event.get('x') + ']'))
              "
      }

```

---

<div class="post-metadata">

**Author:** ![alex\_vermex](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alex_vermex/32/101267_2.png) [@alex\_vermex](https://discuss.elastic.co/u/alex_vermex)\
**Post date:** [May 18, 2022, 11:06am UTC](https://discuss.elastic.co/t/using-field-value-as-value-in-message-x/305035/3 "2022-05-18T11:06:33Z")

</div>

Thank you for the reply @Tomo_M !  
Still not working didn't add me the "field\_name" 😕

````auto
[ERROR][logstash.filters.ruby][main][56a490742ee0bc6336286e224b7d06224a9d39871e407d1979ac5bfe5e9f5cb0] Ruby exception occurred: no implicit conversion of Integer into String {:class=>"TypeError", :backtrace=>["org/jruby/RubyString.java:1182:in `+'", "(ruby filter code):3:in `block in filter_method'", "D:/elastic_stack/logstash-7.16.3/vendor/bundle/jruby/2.5.0/gems/logstash-filter-ruby-3.1.7/lib/logstash/filters/ruby.rb:93:in `inline_script'", "D:/elastic_stack/logstash-7.16.3/vendor/bundle/jruby/2.5.0/gems/logstash-filter-ruby-3.1.7/lib/logstash/filters/ruby.rb:86:in `filter'", "D:/elastic_stack/logstash-7.16.3/logstash-core/lib/logstash/filters/base.rb:159:in `do_filter'", "D:/elastic_stack/logstash-7.16.3/logstash-core/lib/logstash/filters/base.rb:178:in `block in multi_filter'", "org/jruby/RubyArray.java:1821:in `each'", "D:/elastic_stack/logstash-7.16.3/logstash-core/lib/logstash/filters/base.rb:175:in `multi_filter'", "org/logstash/config/ir/compiler/AbstractFilterDelegatorExt.java:134:in `multi_filter'", "D:/elastic_stack/logstash-7.16.3/logstash-core/lib/logstash/java_pipeline.rb:299:in `block in start_workers'"]}```
````

---

<div class="post-metadata">

**Author:** ![alex\_vermex](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alex_vermex/32/101267_2.png) [@alex\_vermex](https://discuss.elastic.co/u/alex_vermex)\
**Post date:** [May 18, 2022, 1:04pm UTC](https://discuss.elastic.co/t/using-field-value-as-value-in-message-x/305035/4 "2022-05-18T13:04:32Z")

</div>

I found the solution 😃

```auto
ruby {
      code => "event.set('DateTime', event.get('message')[event.get('x')])
               event.set('x', (event.get('x')) + 1)
              "
      }

```

Last thing it was about if statement in ruby filter or should i create a new topic ? just a small thing  
here my code :

```auto
ruby {
      code => "event.set('DateTime', event.get('message')[event.get('x')])
               event.set('x', (event.get('x')) + 1)
               event.set('version', event.get('message')[event.get('x')])
               event.set('x', (event.get('x')) + 1)
               event.set('GateWay Op', event.get('message')[event.get('x')])
               event.set('x', (event.get('x')) + 1)
               if GateWay Op = PAIEMENT   
                    event.set('Idtra', event.get('message')[event.get('x')])
                    event.set('x', (event.get('x')) + 1)
               end           
              "
      }

```

I would like to know what is wrong and thank you!

---

<div class="post-metadata">

**Author:** ![Tomo\_M](https://avatars.discourse-cdn.com/v4/letter/t/848f3c/32.png) [@Tomo\_M](https://discuss.elastic.co/u/Tomo_M)\
**Post date:** [May 18, 2022, 2:43pm UTC](https://discuss.elastic.co/t/using-field-value-as-value-in-message-x/305035/5 "2022-05-18T14:43:47Z")

</div>

Thanks, I missed x field is integer.

That if statement should be:

```auto
if event.get('GateWay Op') == 'PAIEMENT'
  event.set(...

```

Another thing I wonder is the following code.

```auto
 mutate {
      add_field => { "GateWay" => "%{[message][2]}" }
}

```

I suppose the field format is recognized as the "2" field in "message" field. I know no way to set some value at a specific position of array by mutate filter plugin. Maybe you need ruby filter plugin.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 15, 2022, 2:44pm UTC](https://discuss.elastic.co/t/using-field-value-as-value-in-message-x/305035/6 "2022-06-15T14:44:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
