Creating an array of values from a combination of range and list values

[cromagnon35 (Jeff Lewis)]

Hello, I've got an interesting problem I'm hoping someone might be able to assist with.

I'm using logstash to ingest data from Oracle which in by itself is working fine. However, I have a field called ziparea which has any combination of the left 3 digits of a given zipcode (we call them geozips), I need to parse this into an array called zip_area in which each distinct value is contained.

For example: "316-320,398"
should create an array : ["316", "317", "318", "319", "398"]

I've done this successfully using ruby via:
zip_area =
split_zip = zip.split(',')
split_zip.each{|zip|
if zip.length == 3
zip_area << zip
else
split_zip = zip.split('-')
beg_zip = split_zip[0].to_i
end_zip = split_zip[1].to_i
for z in beg_zip...end_zip + 1 do
zip_string = z.to_s
for i in zip_string.length...3 do
zip_string = "0" + zip_string
end
zip_area << zip_string
end
end
}
puts "Array content: #{zip_area}"

but I'm unsure how to integrate this with the logstash conf file. I could go either with an external file or it's not so big that inline wouldn't work.

I'm far from a guru in either logstash or ruby, so any assist would be welcome.

[Badger]

    ruby {
        code => '
            zip_area = []
            split_zip = event.get("zip").split(",")
            split_zip.each { |zip|
                if zip.length == 3
                    zip_area << zip
                else
                    split_zip = zip.split("-")
                    beg_zip = split_zip[0].to_i
                    end_zip = split_zip[1].to_i
                    for z in beg_zip...end_zip + 1 do
                        zip_string = z.to_s
                        for i in zip_string.length...3 do
                            zip_string = "0" + zip_string
                        end
                        zip_area << zip_string
                    end
                end
            }
            event.set("zipAreas", zip_area)
        '
    }

will convert

       "zip" => "316-320,398",

into

  "zipAreas" => [
    [0] "316",
    [1] "317",
    [2] "318",
    [3] "319",
    [4] "320",
    [5] "398"
],

[cromagnon35 (Jeff Lewis)]

Thanks Badger! I'll give it a try and let you know.

[cromagnon35 (Jeff Lewis)]

Today's UDAMAN award goes to Badger! A couple of minor tweaks to work inside a bash string (I'm using a bash script to create the conf file programatically) and rename of the the zip field to the incomming ziparea field and it's golden. I owe you a beer now :-).

Here's the section in the resulting conf file for reference:
ruby {
code => "zip_area =
split_zip = event.get('ziparea').split(',')
split_zip.each { |ziparea|
if ziparea.length == 3
zip_area << ziparea
else
split_zip = ziparea.split('-')
beg_zip = split_zip[0].to_i
end_zip = split_zip[1].to_i
for z in beg_zip...end_zip + 1 do
zip_string = z.to_s
for i in zip_string.length...3 do
zip_string = '0' + zip_string
end
zip_area << zip_string
end
end
}
event.set('zipAreas', zip_area)
"
}