Flatten json array in Logstash

Elastic Stack Logstash
7

I just came across this post again via a Google search when looking to solve exactly the same issue. On the basis that others might too, I wanted to add to it some ruby code that might be useful for others doing this, that will combine the elements of an array into a single string:

ruby {
code => 'event["hashtags_array"] = event["[entities][hashtags]"].collect { |m| m["text"] } unless event["[entities][hashtags]"].nil?
event["hashtags_list"] = event["hashtags_array"].join(",")  unless event["[hashtags_array]"].nil?'
}

The first line is just as @jordansissel provided me above; the second line is a hack together that I figured out but seems to work. Example input:

  "entities": {
    "hashtags": [
      {
        "text": "Iran",
        "indices": [
          18,
          23
        ]
      },
      {
        "text": "News",
        "indices": [
          24,
          29
        ]
      }
    ],

Example output:

          "hashtags_array" => [
    [0] "Iran",
    [1] "News"
],
            "hashtags_list" => "Iran,News",