I'm getting there step by step.
ruby { code => "
event.set('mksrevision', [event.get('ID'), event.get('author'), event.get('desc'), event.get('date')].transpose)
array_of_hashes = event.get('mksrevision').collect { |i| {'id' => i[0], 'author' => i[1], 'desc' => i[2], 'date' => i[3]}}
event.set('mks', array_of_hashes)
"}
this creates an array "mks" wich basically has the richt structure
I need to parse each array elemnt as a seperate document to elasticsearch.
edit:
got it after that i used
split {
field => "mks"
}
now its working, thanks magnus for bearing with me and my none existing ruby knowlege