Convert field to an array

Hello,

I'm looking to convert the following field to a hash of values....

Source Field:

"ip_addresses": "{192.168.1.1, 192.168.1.2, 192.168.1.3}"

Desired Result:

"ip_addresses": [
        "192.168.1.1",
        "192.168.1.2",
        "192.168.1.3"
      ],

Any help would be appreciated.... Thank you!

I have not tested it, but you could try

mutate {
    gsub => [ "ip_addresses", "[{}]", "" ]
    split => { "ip_addresses" => "," }
}
mutate { strip => [ "ip_addresses" ] }

Strip has to be in a separate mutate filter to get operations done in the right order.

Thank you Badger for your help.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.