Dynamic fields

Elastic Stack Logstash
1

i want a nestod json like this and my fields contains this string
alice@22#bob@34
i want this json
"dataclass":{

"tags":{
"alice":22,
"bob":34
}
}
where i am wrong please suggest
ruby {
code => '
b = event["fields"].split("#");
ary = Array.new;
for c in b ;
f= c.split("@")[0];
v=c.split("@")[1];
event[f]=v;
event["[dataclass][tags][%{[f]}]"]=v;

        end;
    '
}
1 Like
2

You're overcomplicating things by using a ruby filter. You should be able to use a kv filter. Untested:

filter {
  kv {
    source => "fields"
    target => "[dataclass][tags]"
    field_split => "#"
    value_split => "@"
  }
}
3

but thing is that i want to check in ruby if a field is number then convert it into integer .how can this i do into kv .
as you answered it will take 22 and 34 as string ,how can i convert them into integers ?

4

Oh, I didn't read all of the code. Then perhaps use kv for splitting the string and a ruby filter for conditionally converting the fields?

5

magnus please if you don't mind look at my code again ,i am really stuck how that json can be made using ruby filter .
Til now i can do this .
ruby {
code => '
b = event["fields"].split("#");
ary = Array.new;
for c in b ;
f= c.split("@")[0];
v=c.split("@")[1];
if v =~ /\A\d+\Z/
event[f] = v.to_i
else
event[f] = v
end

        end;
       
    '
}

But the result is that i am not able to get all those key value pairs viz "alice":22 and "bob":34 inside the fields can i use source inside the code block so that these pairs dont add to root .
as i am splitting the string you can understand that my string is dynamic and can include both string and integer values .so i don't know to which to convert to what .

6

please suggest something i am still stuck !

7

If you're having problems writing Ruby code, perhaps you should reduce the amount of Ruby code you need to write by using the kv filter to do the splitting and parsing and using Ruby only to convert the field values to integers?

8

ruby {
code => '
b = event["fields"].split("#");
ary = Array.new;
for c in b ;
f= c.split("@")[0];
v=c.split("@")[1];
if v =~ /\A\d+\Z/
event[f] = v.to_i
else
event[f] = v
end
event["[dataclass][tags][f]"]=v;
this is my ruby code
and thing i am trying to do is create json like
suppose "f" contains field1,field2 as i extracted it from fields string
"dataclass":{
"tags":{
"field1":23,
"field2":"text"
}
}

problem i am having is in [dataclass][tags][f] "f " is not working