How to convert a json field to string by using ruby filter?

Elastic Stack Logstash
1

Hi all. I have a event like:

{"@timestamp":"2016-04-03T08:17:15.202Z","host":"shifudao","type":"rtds","loglevel":"WARN","classname":"hawkeyes.rtds.gate.protocol.frametype.SamplerReportData","logdetail":{"message":"设备00000068数据上报帧里的sid为空，可能未发过心跳，丢弃！","action":"fireEquipmentDataArrived(String writeHandlerID, String sid, Vertx vertx, List result)","sid":null,"params":{"writeHandlerID":"f7d2f035-b90f-4d2d-b9b4-d44a59f0227d","sid":null,"result":[{"eId":"00000068","date":1459672746202,"items":[[4,[26,17,0,0]],[5,[0,0,0,0]],[6,[-4,-1,0,0]],[7,[28,38,0,0]],[8,[-33,0,0,0]],[9,[-65,0,0,0]],[10,[0,0,0,0]],[11,[-52,0,0,0]],[12,[-65,0,0,0]],[32,[0,0,0,0]],[33,[0,0,0,0]],[35,[0,0,0,0]],[38,[-1,0,0,0]],[39,[0,0,0,0]],[40,[0,0,0,0]],[41,[0,0,0,0]],[42,[0,0,0,0]],[43,[0,0,0,0]],[44,[0,0,0,0]],[45,[0,0,0,0]],[48,[34,-55,0,0]],[49,[-36,-65,0,0]],[50,[-36,86,0,0]]]}]}},"@version":"1"}

And here is the rubydebug output:

{
    "@timestamp" => 2016-04-03T08:17:15.202Z,
... SNIP ...
     "logdetail" => {
... SNIP ...
         "params" => {
            "writeHandlerID" => "f7d2f035-b90f-4d2d-b9b4-d44a59f0227d",
                       "sid" => nil,
                    "result" => [
                [0] {
                      "eId" => "00000068",
                     "date" => 1459672746202,
                    "items" => [
                        [ 0] [
                            [0] 4,
                            [1] [
                                [0] 26,
                                [1] 17,
                                [2] 0,
                                [3] 0
                            ]
                        ],
                        [ 1] [
... SNIP ...
      "@version" => "1"
}

Now I want to convert the logdetail.params filed to string, how to ?

I've tried:

filter {
    ruby {
        code => "
            event['logdetail']['params'] = event['logdetail']['params'].to_s
        "
    }
}

But nothing happens.

2

Did you look at the code of the json_encode filter as I suggested earlier?

3

Yes, but for some reason I cannot install the plugin. So I want use built-in filter as far as possible.

I've look at the source code, but it's a little hard to me. And for me hash.to_s is more fit than json.dump, because some of this field is just string.

I try to copy the code like event['logdetail']['params'] = event['logdetail']['params'].to_s, but nothing happens.

4

I've been solved my issue.

    ruby {
        code => "
            field_to_be_converted = ['[logdetail][params][result]',
                                     '[logdetail][params][body]',
                                     '[logdetail][params][item]',
                                     '[logdetail][params][items]']
            for field in field_to_be_converted
                if event.include?(field) && event[field].class != String
                    event[field] = event[field].to_s
                end
            end
        "
    }

I'm not sure why this code could work.

1 Like