Contructing JSON array output from logstash

Elastic Stack Logstash
1

Hi,
I am reading a log file where I have key value paired events. I extract the key value fields using KV filter and then construct a JSON manually like the below.

"[application][environment]" => "%{environment}"
"[application][applicationName]" => "%{applicationName}"
"[application][applicationModuleName]" => "%{applicationModuleName}"
"[application][auditStepName]" => "%{auditStepName}"
"[application][applicationModuleVersion]" => "%{applicationModuleVersion}"
.
.
.
"[DetailSection][elementDetail][rejectCode]" => "%{rejectCode}"
"[DetailSection][elementDetail][rejectReasonDescription]" => "%{rejectReasonDescription}"
"[DetailSection][elementDetail][severity]" => "%{severity}"

I have a requirement where in the elementDetail in the schema can only be an array and hence the JSON generated out of this is throwing schema error.
I tried using [DetailSection][elementDetail][0][rejectCode], "[DetailSection][elementDetail][0][rejectReasonDescription]", but they dont work the intended way.

Any help is greatly appreciated!!

2

If you have a field called rejectCode, then you can create an array inside an object using

mutate { add_field => { "[DetailSection][elementDetail][0][rejectCode]" => "%{rejectCode}" } }

That will produce

              "DetailSection" => {
        "elementDetail" => {
            "0" => {
                "rejectCode" => "a"
            }
        }
    },

What issue do you have with that?

3

I am getting the below JSON response rather than the expected respone as array:

"DetailsSection"{
"elementDetail": {
"0": {
"reject code":"a"
}
}
}

Exepected Response:

"DetailsSection"{
"elementDetail": [
{
"reject code":"a"
}
]
}

4

Depending on whether you want the array to contain a single object or multiple objects...

    ruby {
        code => "
        a = []
        h = Hash.new
        event.to_hash.each { | k, v |
            if k == 'rejectCode' || k == 'rejectReasonDescription'
                # For an array where each entry contains a single object has use this instead
                #a << { k => v }
                h[k] = v
            end
        }
        a << h
        event.set( '[DetailSection][elementDetail]', a)
        "
    }
5

That worked like a charm. Thank you so much :slight_smile:

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.