Access dynamic array

Hi,

I can't figure that out, I'm pretty sure I missed something

I want to access the last line of this array.

    "logs" => [
        [0] 23:33:39 Sep 15, 2019 - Delivered "19-09-15_23-33-37.127558/file_01_01_01.xml",
        [1] 23:33:39 Sep 15, 2019 - Delivered "19-09-15_23-33-37.127558/file_02_02_02.xml", 
        [2] 23:33:39 Sep 15, 2019 - Delivered "19-09-15_23-33-37.127558/file_03_03_03.xml"
    ],

Since the number of row is dynamic the row number must change

I use those script to determine the last row number

ruby {	
  code => "
  new_value = event.get('logs').length
  event.set('number_of_row',new_value)
  "
  }

  ruby {
    code => "
    event.set('last_row_number', event.get('number_of_row') - 1);
    "
    } 

last_row_number == 2

mutate {add_field => { "test" => "[logs][2]"}}

Return good result

But I can't find the correct syntax to set this dynamically

mutate {add_field => { "test" => "[logs][%{last_row_number}]"}}

doesn't work

Thanks for your help`

Why not just do it in a single ruby filter?...

ruby { code => 'event.set("lastLine", event.get("logs")[-1])' }

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.