Converting a json field to a list json

[E.Eric (Eric)]

Hi,

having a field:

"aa": {
"b":"123",
"c":"123"
}

I want to convert that field to a list JSON with one object:

"aa": [
{
"b":"123",
"c":"123"
}
]

Thanks in advance!

[magnusbaeck (Magnus Bäck)]

I think you need to use a ruby filter for this. This piece of code probably works:

event.set('aa', [event.get('aa')])

This seems like a rather strange transform. Why do you want to do this?

[E.Eric (Eric)]

I need this because I have a module that is waiting for a list json to parse it and extract data.
I've trayed this filter :

ruby {
code => "
require 'json'
event['res'] = [JSON.parse(event['message'])['aa']]
"
}
but it generates this error:

Ruby exception occurred: can't convert Hash into String {:level=>:error}

[magnusbaeck (Magnus Bäck)]

Why would you need do any JSON conversion? Did you try my suggestion? Which version of Logstash?

[E.Eric (Eric)]

it generates an error : version 2.3

[magnusbaeck (Magnus Bäck)]

For 2.3 this should work:

event['aa'] = [event['aa']]

[E.Eric (Eric)]

it works... Thank you very much !