Convert field to an array

[JeremyP]

Hello,

I'm looking to convert the following field to a hash of values....

Source Field:

"ip_addresses": "{192.168.1.1, 192.168.1.2, 192.168.1.3}"

Desired Result:

"ip_addresses": [
        "192.168.1.1",
        "192.168.1.2",
        "192.168.1.3"
      ],

Any help would be appreciated.... Thank you!

[Badger]

@JeremyP

"ip_addresses": "{192.168.1.1, 192.168.1.2, 192.168.1.3}"

I have not tested it, but you could try

mutate {
    gsub => [ "ip_addresses", "[{}]", "" ]
    split => { "ip_addresses" => "," }
}
mutate { strip => [ "ip_addresses" ] }

Strip has to be in a separate mutate filter to get operations done in the right order.

[JeremyP]

Thank you Badger for your help.