Can i construct an array of hashes from array of strings

Elastic Stack Logstash
1

Using Logstash 5.6.

Given a single event (a string) that contains a number of lines like (a) I need to create an array of hashes to produce the output (b)

so far I can produce an array of strings using the mutate filter
mutate { copy => { "message" => "errors"} }
mutate {
gsub => ["[errors]", "ERROR", "|"]
split => { "[errors]" => "|" } # creates an array of strings
}

But I can't figure out how to convert the array of strings into an array of hashes. Can't find any equivalent topics.

(a) message => "ERROR Code=123, SubCode=XYZ\r\nERROR Code=121, SubCode=XJA\r\n"
nb: ... (variable number of errors)

(b) the final output (rubydebug) would look like:
{
"message" => "ERROR Code=123, SubCode=XYZ\r\nERROR Code=121, SubCode=XJA\r\n",
"@timestamp" => 2018-02-28T15:14:40.150Z,
"errors" => [
[0] {Code=>"123", SubCode=>"XYZ" },
[1] {Code=>"121", SubCode=>"XJA"}
]
}

2

I think you'll have to write some custom code in a ruby filter.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.