Concatenate multi arrays into one using ruby

Elastic Stack Logstash
1

hi all,
I have following arrays as following:
f1={a1,a2,a3,a4}
f2={b1,b2,b3,b4}
f3={c1,c2,c3,c4}
f4={d1,d2,d3,d4}

I want to merge these arrays into one array as following which data of each element of new array separated by ":"
result={[a1:b1:c1:d1],[a2:b2:c2:d2],[a3:b3:c3:d3],[a4:b4:c4:d4]}

after that i want to use split filter on "result" field to separate the arrays elements.
how can i do above merging in ruby filter?

2

If you want to set a field as an array of existing fields then the general form would be

ruby { code => 'event.set("result", [ event.get("foo"), event.get("bar") ])' }
3

it doesn't seem it leads to following format:

a1:b1:c1:d1

actually i want to concatenate the elements of multiple array into one array so that component of ith element of new array consist of componenets of ith elemement of other arrays so that separated using ":"

4

It is unclear what you want, since you use {} for things that you say are arrays and square brackets for things that cannot be arrays. However, you could try something like this

    ruby {
        code => '
            f1 = event.get("f1")
            f2 = event.get("f2")
            f3 = event.get("f3")
            f4 = event.get("f4")
            a = []
            f1.each_index { |i|
                a << "#{f1[i]}:#{f2[i]}:#{f3[i]}:#{f4[i]}"
            }
            event.set("result", a)
        '
    }

which results in

    "result" => [
    [0] "a1:b1:c1:d1",
    [1] "a2:b2:c2:d2",
    [2] "a3:b3:c3:d3",
    [3] "a4:b4:c4:d4"
],
5

many thanks. @Badger
I used it but following result had been returned:
"result": [
"#{f1[i]}:#{f2[i]}:#{f3[i]}:#{f4[i]}",
"#{f1[i]}:#{f2[i]}:#{f3[i]}:#{f4[i]}",
"#{f1[i]}:#{f2[i]}:#{f3[i]}:#{f4[i]}",
"#{f1[i]}:#{f2[i]}:#{f3[i]}:#{f4[i]}"
],

6

I solved the issue using following code; difference is "," is instead of ":"

ruby {
code => "
event.set('result',event.get('f1').zip(event.get('f2'),event.get('f3'),event.get('f4')))
"
}

now there is another issue; i want to split the result to multi events based on the array's element; therefore, i want to have for event as following:
event 1: {a1:b1:c1:d1}
event 2:{a2:b2:c2:d2}
event 3: {a3:b3:c3:d3}
event 4: {a4:b4:c4:d4}
fore this purpose, i used split filter as following:
split {
field => "result"
}
but following warning has been found at the log:

[WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"a_totaltx14_1398-03-31", :_type=>"doc", :routing=>nil}, #LogStash::Event:0x7b3dbee2], :response=>{"index"=>{"_index"=>"a_totaltx14_1398-03-31", "_type"=>"doc", "_id"=>"9UtHiGsBPU7RNT0U0c26", "status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"mapper [result] of different type, current_type [long], merged_type [text]"}}}}

could you please advise me about this?

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.