How can I make iteration & loop in logstash?

(Jongmin Kim) #1

Hi, I have string data looks like next.


I want parse the value of "detail" field.
First I split with character ","


and for finally I want get field look like next.

"detal_new" : { "B01" : 10, "B02" : 10, "BANK02": 10, "BANK01" : 50, "F04" : 10 }

Now, I need make a loop with "detail" field, and have to split each value with "=".
Then I guess make another object type field with %{value[0]} => %{value[1]}.
I heard that if I want make loop in Logstash, I have to use ruby filter. Unfortunately I'm not familiar with ruby.
Can anyone help me how this can be figured out?

Thank you, for reading and helping me.

(Magnus B├Ąck) #2

Just use the kv filter.

filter {
  kv {
    source => "detail"
    target => "detail_new"
    field_split => ","

The values will be strings instead of numbers, but you can use a mutate filter for the type conversion. If you don't know which fields you've got you'll indeed probably have to use a ruby filter.

(Jongmin Kim) #3

I didn't tried kv filter before.
I tryed and it works perfectly. I got exact data I wanted. Thanks a lot :smile:

(system) #4