How can I flatten an array in my document

Elastic Stack Logstash
1

I am attempting to flatten an array either in logstash or ingestion processor.

"clientType" : "Desktop Browser",
"stringProperties" : [
{
"key" : "usertype",
"applicationId" : "Client",
"internalApplicationId" : "APPLICATION-89",
"value" : "R"
},
{
"key" : "firmid",
"applicationId" : "Client",
"internalApplicationId" : "APPLICATION-89",
"value" : "1"
},
{
"key" : "firmname",
"applicationId" : "Client",
"internalApplicationId" : "APPLICATION-89",
"value" : "ABC"
}

any help would be appreciated. I am having trouble figuring the best way to do this, ultimately I would like it to look like this

"clientType" : "Desktop Browser",
"stringProperty.usertype" : "R",

3

Use a ruby filter. I have not tested it but something like this...

ruby {
    code => '
        props = event.get("stringProperties")
        if props
            props.each { |x|
                key = x["key"]
                event.set("stringProperties.#{key}", x["value"])
            }
            event.remove("stringProperties")
        end
    }
}
4

thank you, will try it out and let you know.

5

I have never used ruby but I am getting an error does the string have an end?

code => 'start of string, but i see no end '

6

That should be

        end
    '
}
7

That worked perfectly thank you very much.

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.