Converting a json field to a list json

Elastic Stack Logstash
1

Hi,

having a field:

"aa": {
"b":"123",
"c":"123"
}

I want to convert that field to a list JSON with one object:

"aa": [
{
"b":"123",
"c":"123"
}
]

Thanks in advance!

2

I think you need to use a ruby filter for this. This piece of code probably works:

event.set('aa', [event.get('aa')])

This seems like a rather strange transform. Why do you want to do this?

3

I need this because I have a module that is waiting for a list json to parse it and extract data.
I've trayed this filter :

ruby {
code => "
require 'json'
event['res'] = [JSON.parse(event['message'])['aa']]
"
}
but it generates this error:

Ruby exception occurred: can't convert Hash into String {:level=>:error}

4

Why would you need do any JSON conversion? Did you try my suggestion? Which version of Logstash?

5

it generates an error : version 2.3

6

For 2.3 this should work:

event['aa'] = [event['aa']]
1 Like
7

it works... Thank you very much !

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.