Create fields from the objects that are a part of array in Logstash filter

Elastic Stack Logstash
1

In Logstash, in my event object there is a field that is an array. This field contains objects. I have to create or add some new fields in the event object and these fields will be created on the basis of the objects that are present in this array field.
For example, suppose I have the below field in my event object:

{
  "data_items": [
    {
      {
        "unit": "bytes",
        "value": 752
      },
      {
        "unit": "ms",
        "value": 15
      }
    }
  ]
}

Now, I want to create 2 new fields for these 2 objects that are present in the data_items field and they will be assigned the value from the "value" field of the corresponding object in the array. For example, I have to add these fields in my event object:

field_bytes:752,
field_ms: 15

My question is that is there any easy way to do this? The order of the objects in the array is random. I know that using if statements and add_field options I can achieve this but is there any easy way to do this. Thanks

2

You could use a ruby filter like this. Note the correction to that post in the final post of the thread.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.