Flatten recursively a JSON to Logstash in Ruby

Elastic Stack Logstash
2

I cannot think of a way to do what you want. The problem is that you want to replace an array with additional hash entries. That appears to require knowing where you are in the event although it is conceivable there is a way to do a merge into the parent field.

The closest I can get is this

def register(params)
    @field = params['field']
end

def processArray(a)
    newHash = {}
    a.each_index { |x|
        newHash["entry#{x}"] = processObject(a[x])
    }
    newHash
end

def processHash(h)
    newHash = {}
    h.each { |k, v|
        newHash[k] = processObject(v)
    }
    newHash
end

def processObject(v)
    if v.kind_of?(Array)
        processArray(v)
    elsif v.kind_of?(Hash)
        processHash(v)
    else
        v
    end
end

def filter(event)
    v = event.get(@field)
    if v
        event.remove(@field)
        event.set(@field, processObject(v))
    end
    [event]
end

which you would invoke using

    ruby {
        path => "/home/user/Ruby/FlattenArrays.rb"
        script_params => { "field" => "payload" }
    }

and it will produce

   "payload" => {
    "entry0" => {
               "route" => "/v1/things",
              "method" => "PUT",
        "content-type" => "json",
                "body" => {
            "licencePlate" => "ZZ123ZZ"
        },
              "status" => 200
    },
    "entry1" => {
               "route" => "/v2",
              "method" => "DEL",
        "content-type" => "html",
                "body" => {
            "entry0" => {
                "plate" => "67S8DFSDF125V-952",
                "infos" => "diverse"
            },
            "entry1" => {
                "plate" => "DZEC12CD-856"
            }
        },
              "status" => 400
    }
},
1 Like