How to access / address nested fields on Logstash

Hello, I am currently trying to convert a nested sub field that contains hexadecimal string to an int type field using Logstash filter

    code => 'event.set("[transactions][gasprice_int]", event.get("[transactions][gasPrice]").to_i(16))'

but it's returning the error

[ERROR][logstash.filters.ruby    ][main][2342d24206691f4db46a60285e910d102a6310e78cf8af43c9a2f1a1d66f58a8] Ruby exception occurred: wrong number of arguments calling `to_i` (given 1, expected 0)

This method of conversion of hex-string to int type worked when I wasn't dealing with nested fields, so can anyone please help me how to correctly address nested fields in this case?


this is the code that still works

ruby {
    code => 'event.set("difficulty_int", event.get("difficulty").to_i(16))'

That probably has less to do with gasPrice being a subfield and more with it not being the data type you think it is. The function to_i on strings supports the parameter to define the base. On other data types it doesn't. If you put the following line before the code for your conversion, what does it say?
puts event.get("[transactions][gasPrice]")

1 Like

As Jenni says, this could be because the field does not have the type you think it has. Perhaps

1 Like

It was a string of hexadecimal, and the type of the field was 'keyword'.
For those of you who are having the same problem, I had multiple elements in 'transactions' field thus had multiple values of 'gasPrice'.
Looping through each transaction fixed the error.

transactions_num = event.get("[transactions]").size
      transactions_num.times do |index|
        event.set("[transactions][#{index}][gasprice_int]", event.get("[transactions][#{index}][gasPrice]").to_i(16))

This is how I fixed it and it worked.

Still, thank you so much for people who left the replies and tried to help!!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.