Using Logstash 5.6.
Given a single event (a string) that contains a number of lines like (a) I need to create an array of hashes to produce the output (b)
so far I can produce an array of strings using the mutate filter
mutate { copy => { "message" => "errors"} }
mutate {
gsub => ["[errors]", "ERROR", "|"]
split => { "[errors]" => "|" } # creates an array of strings
}
But I can't figure out how to convert the array of strings into an array of hashes. Can't find any equivalent topics.
(a) message => "ERROR Code=123, SubCode=XYZ\r\nERROR Code=121, SubCode=XJA\r\n"
nb: ... (variable number of errors)
(b) the final output (rubydebug) would look like:
{
"message" => "ERROR Code=123, SubCode=XYZ\r\nERROR Code=121, SubCode=XJA\r\n",
"@timestamp" => 2018-02-28T15:14:40.150Z,
"errors" => [
[0] {Code=>"123", SubCode=>"XYZ" },
[1] {Code=>"121", SubCode=>"XJA"}
]
}