Creating arrays in ruby

Elastic Stack Logstash
1

I am trying to set an event with multiple records in an array as follows

ruby {
            code => "
            begin
                event.set('[fieldname][0]', 'This is record 0')
                event.set('[fieldname][1]', 'This is record 1')
            end"
}

Then I am trying to split that into two separate documents

split {
    field => '[fieldname]'
}

This doesn't give me an error but it doesn't split the field either.

2

What does the resulting event look like then? Use a stdout { codec => rubydebug } output.

I'd use

event.set('fieldname', ['Record 0', 'Record 1'])

to create an array field.

3

That works well. How can I add fields to that array on multiple lines? Something like

event.set('fieldname', ['Record 0',])
event.set('fieldname', ['Record 1',])

Obviously the problem with this is that the second line just overwrites the first.

I also tried

event.set('fieldname', ['Record 0',])
event.set('fieldname', [event.get(fieldname), 'Record 1'])

That just nests the first record further.

4 
event.set('fieldname', event.get(fieldname) + ['Record 1'])
2 Likes
5

Brilliant. Thank you.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.