Converting array of strings to array of dict

Elastic Stack Logstash
1

Hi,

I've data that gets parsed to:

{...
message => ["line1: message1", "line2: message2"]
}

and I can mutate it easily to:

{...
"lines" => [1,2]
"text" => ["message1", "message2"]
}

via:

grok {"message"=> "line(?[0-9]):(?.)"}

however what I'd like is to have:

{...
entries=> [{"line": 1, "text": "message1"}, {"line": 2, "text": "message2"}]
}

any idea of how to do that?

2

It might be possible with a long series of "standard" filters, but a ruby filter would be the easiest way. You can access the input values via event['message'] and set the output value by assigning to event['entries'].

3

Ok. Thanks. That’s what I did in the end. Would be nice to have a
“zip” filter.