Convert string to array in logstash

[BlueSpirit (Aditya Gupta)]

My original data.

{
  message: {
      data: "["1,2","3,4","5,6"]"
  }
}

Now I want to convert value of data field to an array.
So it should become:

{
  message: {
      data: ["1,2", "3,4", "5,6"]
  }
}

By using

mutate {
    gsub => ["data", "[\[\]]", ""]
  }

I got rid of square brackets.

After this, I tried splitting based on commas. But that won't work. Since my data has commas as well.

I tried writing a dissect block but that is not useful.

So how should I go ahead with this?

[Badger]

@BlueSpirit

{ data: "["1,2","3,4","5,6"]" }

Transform "," into a character that you can split on?

    mutate { gsub => [ "data", '","', '|', "data", '^\["', "", "data", '"]$', "" ] }
    mutate { split => { "data" => '|' } }

[BlueSpirit (Aditya Gupta)]

Nice approach.

Although, I fixed it by using

json{
  source => "message"
}
json {
  source => "data"
  target => "data"
}