Creating object with ruby

Elastic Stack Logstash
1

Hi all,

I have an event with fields containing tables:

{"pfp":{"cfr":["A", "B", "C"], "name":["X", "Y", "Z"]}}

I would like to transform them into objects:

"pfp" => [
[0] {
"cfr" => "A",
"name" => "X"
},
[1] {
"cfr" => "B",
"name" => "Y"
},
[2] {
"cfr" => "C",
"name" => "Z"
}
]

I tried to do this with ruby unsuccessfully...

My best try was:

filter {
ruby {
code => '
if event.get("[pfp][cfr]").length == event.get("[pfp][name]").length
event.get("[pfp][cfr]").each_index { |i|
event.set("[pfp_tmp]", [Hash["cfr",event.get("[pfp][cfr][#{i}]"),"name",event.get("[pfp][name][#{i}]")]])
}
end
'
}
}

But the result is (I put the result into a new field 'pfp_tmp' in order to compare it with the source):

{
"pfp_tmp" => [
[0] {
"cfr" => "C",
"name" => "Z"
}
],
"pfp" => {
"cfr" => [
[0] "A",
[1] "B",
[2] "C"
],
"name" => [
[0] "X",
[1] "Y",
[2] "Z"
]
}
}
As you can see, the pfp_tmp field is not a table, only the last data is present.

I also tried to set the field with event.set("[pfp_tmp][#{i}]", ... but the result was pfp_tmp => { "0" => {...}, "1"=> {...} which is not really a table

Any idea?
Thank you for help.

2 
    ruby {
        code => '
            if event.get("[pfp][cfr]").length == event.get("[pfp][name]").length
                a = []
                event.get("[pfp][cfr]").each_index { |i|
                    a << Hash["cfr",event.get("[pfp][cfr][#{i}]"),"name",event.get("[pfp][name][#{i}]")]
                }
                event.set("[pfp_tmp]", a)
            end
        '
    }
3

Thx Badger,
It works fine !!

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.