Beginner question add new field based on field in array of json objects

Elastic Stack Logstash
1

We have input json objects looks like below

{
  "ids": [
    {
      "id": 1,
      "name": "name1"
    },
    {
      "id": 2,
      "name": "name2"
    }
  ],
  "codes": [
    {
      "code": "4"
    },
    {
      "code": "2"
    }
  ]
}

{
      "ids": [
        {
          "id": 1,
          "name": "name1"
        },
        {
          "id": 2,
          "name": "name2"
        }
      ],
      "codes": [
        {
          "code": "1"
        },
        {
          "code": "2"
        }
      ]
    }

I want to add a new field and set to "Y" to json object if "name1" exists in "ids" and "4" exists in "codes" else set it to "N".
So i added in filter

if [ids][name] == "name1" and [codes][code] == "4" {
mutate{add_field=>{"new_field":"Y"}}
}else{
mutate{add_field=>{"new_field":"N"}}
}

but it always setting to "N"

Can someone help me out here?

2

You'll have to use a ruby filter for this. Untested:

if event.get('ids').find { |i| i['name'] == 'name1' } && event.get('codes').find { |i| i['code'] == '4' }
  event.set('new_field', 'Y')
else
  event.set('new_field', 'N')
end
}
3

Thanks It Worked.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.