Converting array of strings to array of dict

(Giulio Eulisse) #1


I've data that gets parsed to:

message => ["line1: message1", "line2: message2"]

and I can mutate it easily to:

"lines" => [1,2]
"text" => ["message1", "message2"]


grok {"message"=> "line(?[0-9]):(?.)"}

however what I'd like is to have:

entries=> [{"line": 1, "text": "message1"}, {"line": 2, "text": "message2"}]

any idea of how to do that?

(Magnus Bäck) #2

It might be possible with a long series of "standard" filters, but a ruby filter would be the easiest way. You can access the input values via event['message'] and set the output value by assigning to event['entries'].

(Giulio Eulisse) #3

Ok. Thanks. That’s what I did in the end. Would be nice to have a
“zip” filter.

(system) #4