Convert key value pair into hash

I have a field p1 with the value as partition=root,size=23.28GB,free=15.76GB

p1 : partition=root,size=23.28GB,free=15.76GB

I want to store this in an array field and the values in a hash, like below.

[partition][root] : {
                     size = 23.28GB,

Please help me to achieve this.

If you want the field name to be a variable you will have to use a ruby filter.

    dissect { mapping => { "p1" => "partition=%{[@metadata][partitionName]},size=%{[@metadata][size]},free=%{[@metadata][free]}" } }
    ruby {
        code => '
            h = { "size" => event.get("[@metadata][size]"), "free" => event.get("[@metadata][free]") }
            name = event.get("[@metadata][partitionName]")
            event.set("[partition][#{name}]", h)

Error handling is left as an exercise for the reader.

If you want to convert those GB to actual numbers then check out the bytes filter.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.