Access array in ruby loop

Elastic Stack Logstash
1

Hello,

I would like to create new fields based on an array coming from a splitted field and associate the value of each fields

          dtab = data.split(/(\w{20})(\w{20})(\w{20})(\w{20})(\w{20})(\w{20})(\w{20})(\w{20})(\w{20})(\w{20})(\w{20})(\w{20})(\w{20})(\w{20})(\w{20})(\w{20})\w{2}\w{2}\w{2}/)
      dtab.shift
      event.set('[metadata][dtab]', dtab)

      event.get('[metadata][dtab]').each_with_index do |hash, index|
        event.set( '[tire][' +[index]+ ']', hash[value])
      end

Source:
"metadata": {
"dtab": [
"ff000000ffff807f00ff",
"ff000000ffff807f00ff",
"ff000000ffff807f00ff",
"ff000000ffff807f00ff",
"ff000000ffff807f00ff",
"ff000000ffff807f00ff",
"ff000000ffff807f00ff",
"ff000000ffff807f00ff",
"ff000000ffff807f00ff",
"ff000000ffff807f00ff",
"ff000000ffff807f00ff",
"ff000000ffff807f00ff",
"ff000000ffff807f00ff",
"ff000000ffff807f00ff",
"ff000000ffff807f00ff",
"ff000000ffff807f00ff"
]
}

Result:
[tire][1] = value1 (ff000000ffff807f00ff)
[tire][2] = value2 (ff000000ffff807f00ff)
...
[tire][16] = value16 (ff000000ffff807f00ff)

BR

2

What is the question?

3

Sorry,

Fromthe [metadata][dtab] field I need to create fields:
[tire][1] = value1 (ff000000ffff807f00ff)
[tire][2] = value2 (ff000000ffff807f00ff)
...
[tire][16] = value16 (ff000000ffff807f00ff)

by using a ruby filter with a loop but I dont succeed to get index and value.
Maybe I have to use only .each as there is no index in this case and create index by myself.

4

Still not entirely clear. If you want

      "tire" => {
    "11" => "ff000000ffff807f00ff",
    "12" => "ff000000ffff807f00ff",
    "13" => "ff000000ffff807f00ff",
    "14" => "ff000000ffff807f00ff",
    "15" => "ff000000ffff807f00ff",
     "0" => "ff000000ffff807f00ff",
     "1" => "ff000000ffff807f00ff",
     "2" => "ff000000ffff807f00ff",
     "3" => "ff000000ffff807f00ff",
     "4" => "ff000000ffff807f00ff",
     "5" => "ff000000ffff807f00ff",
     "6" => "ff000000ffff807f00ff",
     "7" => "ff000000ffff807f00ff",
     "8" => "ff000000ffff807f00ff",
     "9" => "ff000000ffff807f00ff",
    "10" => "ff000000ffff807f00ff"
}

then you can use

        code => '
            event.get("[metadata][dtab]").each_with_index do |hash, index|
                event.set("[tire][#{index}]", hash)
            end
        '

String interpolation only works inside double quotes, which is why I almost always use single quotes to surround the code.

5

That is what I need I guess.
I was surrounded the code using double quote and wondering how to use double quote inside in order to use #{variable}. I will try.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.