How can I create new field inside an array of obejcts?

Elastic Stack Logstash
#1

Hello!
I have the following array:
{
"tempoTotalDayEvents" : [
{
"tempo7" : 25.0
},
{
"tempo8" : 0.0
},
{
"tempo11" : 0.0
},
{
"tempo12" : 6.0
},
{
"tempo13" : 0.0
},
{
"tempo14" : 3.0
},
{
"tempo15" : 323.0
},
{
"tempo16" : 0.0
},
{
"tempo17" : 163.0
},
{
"tempo18" : 1170.0
}
And I need to create a new field inside of each object with the value inside the key name and remove after, like the following:
{
"tempo" : 25.0
"hora":07
},
{
"tempo" : 0.0
"hora":08
},
{
"tempo" : 0.0
"hora":11
},
{
"tempo" : 6.0
"hora":12
},
{
"tempo" : 0.0
"hora":13
},
{
"tempo" : 3.0
"hora":14
},
{
"tempo" : 323.0
"hora":15
},
{
"tempo" : 0.0
"hora":16
},
{
"tempo" : 163.0
"hora":17
},
{
"tempo" : 1170.0
"hora":18
}
Is it possible?

#2

You could start with

    ruby {
        code => '
            t = event.get("tempoTotalDayEvents")
            if t.is_a? Array
                t.each_index { |x|
                    matches = t[x].keys[0].scan(/^tempo(\d+)$/)
                    t[x]["hora"] = matches[0][0].to_i
                }
                event.set("tempoTotalDayEvents", t)
            end
        '
    }

which produces

"tempoTotalDayEvents" => [
    [0] {
          "hora" => 7,
        "tempo7" => 25.0
    },
    [1] {
          "hora" => 8,
        "tempo8" => 0.0
    },
    [2] {
           "hora" => 11,
        "tempo11" => 0.0
    },

which is not quite what you asked for, but what you asked for is not valid.

Note that the call to t[ x].keys[0].scan makes all kinds of assumptions about the structure of the entries in [tempoTotalDayEvents]. If those assumptions turn out to be invalid then it will result in exceptions. Ideally you should add code to test those assumption, or else to catch the exceptions.

1 Like
#3

Thank you very much again! You saved my ass 2 times in a weak!
Thank you!!