How to convert array to string

Hi,

I would like to convert an array of json objects into an array of string.

Is there any way to do this?

In the folowing json, I'd like to convert the "routes" and the "response" array into an array of strings.

{  
  "client":"appCol",
  "version":"",
  "platform":"",
  "userId":"",
  "sessionToken":"",
  "serviceName":"Login",
  "serviceUri":"/mobilidade/colmobile/v1/autenticacao/login",
  "method":"POST",
  "apiStatus":"",
  "request":"https://apihml:8443/mobilidade/colmobile/v1/autenticacao/login",
  "elapsedTime":"898",
  "dateTime":"2019-03-29T14:44:53.626-03:00",
  "routes":[  
     {  
        "payload":{  
           "grantType":"customCol",
           "clientId":"a7dd9185-30c1-4119-bf6e-8e9460807a27",
           "susep":"S5005J",
           "cpf":"11144477735",
           "colmobileVersion":"",
           "colmobilePlatform":""
        },
        "route":"https://localhost:8443/auth/oauth/v2/token",
        "status":"200",
        "latencyTime":"889"
     }
  ],
  "response":{  
     "access_token":"d5df0a80-827b-4f06-94bd-26ed68334778",
     "token_type":"Bearer",
     "expires_in":3600,
     "refresh_token":"26c39489-6e24-4cc1-a027-cc4c16b5de19",
     "scope":"oob",
     "message":{  
        "status":"success",
        "message":"Sessão gerada com sucesso + Mapa de valores",
        "data":{  
           "entry":[  
              {  
                 "key":"AUTHTOKEN",
                 "value":"vgupWcJhv76jKwsAkRifdAa6q3DYHHOdZMPukr3yV0iG38QM+xGSK9l1+rmP3X33dGsCK5NAYFuwmMsPps2dNA=="
              },
              {  
                 "key":"AUTHTOKEN_JWT",
                 "value":"eyJhbGciOiJSUzUxMiJ9.eyJ1aWQiOiIxMTE0NDQ3NzczNSIsImxnaWF1eGNvZCI6IlM1MDA1SiIsInNlc3NlZ3B0bCI6InZndXBXY0podjc2akt3c0FrUmlmZEFhNnEzRFlISE9kWk1QdWtyM3lWMGlHMzhRTSt4R1NLOWwxK3JtUDNYMzNkR3NDSzVOQVlGdXdtTXNQcHMyZE5BPT0iLCJwc3JvbGUiOltdLCJleHBQb3J0YWwiOjE1NTM4ODMyMzUsImlzcyI6Imh0dHBzOlwvXC93d3dzLnBvcnRvc2VndXJvLmNvbS5iciIsImNuIjoiMTExNDQ0Nzc3MzUiLCJwb3J0YWwiOjEsImV4cCI6MTU1Mzg4MjMzNX0.M-NUk0X63FuvMRgDlxPo2cwQfw3ap7EMrAjtHsyOvf_8-XrRhw4hDtoCiGMIpciyY4rPVT6sNMFLKWBLL9dA3z2IBunZ9PKSzgtPV7oYB_k8LBHmGRMEB5Q3059Xgti0NRfC2P0RQ1xbefEHLVhG4oTHG0uBrIt_oKDfeIUEVwdll4ze7cdklgwAt_s84DIscLn6nH7G_gq33iv98nl6Y4BmERCxORxnk8fNOfdasAnshDcnYRy8r2cDnjbgMhMwToEiFiYyZK-dNfpp0gBNwyjT_b8TT17cgmYlWDee0Uq0i2zBIgeBI3W1H7Oq9pFKDlO_f1ilY2jjXhTkNqR7cQ"
              },
              {  
                 "key":"LEGACYSESSION",
                 "value":"portal=1&corsus=S5005J&webusrcod=14850&usrtip=S&sesnum=3961344&cpf=11144477735"
              }
           ]
        },
        "password_expired":false
     }
  }
}

I tried to user mutate, convert, as the folowing filter:

input {
lumberjack {
    port => 5002
    ssl_certificate => "/elasticsearch/elasticsearch/config/certs/lumberjack.cert"
    ssl_key => "/elasticsearch/elasticsearch/config/certs/lumberjack.key"
  }
}

filter {
    grok {
        ### Regex para interceptar as mensagens do cartão
            match => [ "message" , "%{YEAR}-%{MONTHNUM}-%{MONTHDAY}[T ]%{HOUR}:?%{MINUTE}(?::?%{SECOND})?%{ISO8601_TIMEZONE}? INFO    %{NUMBER:pid} com.l7tech.log.custom.colmobile.logger: -4: %{GREEDYDATA:log_cartao}"]
        }

    mutate{
        ####atualiza o valor da mensagem
        update => { "message" => "%{[log_cartao]}"}
        remove_field => [ "log_cartao"]
        remove_field => [ "matched"]
    }
    json {source => "message"}

    mutate { "convert" => [ "elapsedTime" , "integer" ] }
    mutate { "convert" => [ "route"       , "string"  ] }
    mutate { "convert" => [ "response"    , "string"  ] }

    mutate { remove_field => [ "message"] }
}

output {
  #stdout { codec => rubydebug }

  elasticsearch {
               hosts => ["https://li50078.portoseguro.brasil:9200"]
               index => "appcolmobile-%{+YYYY.MM.dd}"
               manage_template => true
               template_name => "appcolmobile"
               document_type => "doc"
               user => "elastic"
               password => "ujhnby78"
               ssl => true
               ssl_certificate_verification => true
               truststore => "/elasticsearch/elasticsearch/config/certs/elastic-corphml.keystore"
               truststore_password => elasti18
  }
}

But got the folowing error:

[2019-03-29T17:22:43,436][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"appcolmobile-2019.03.29", :_type=>"doc", :_routing=>nil}, #LogStash::Event:0x2d6b57a6], :response=>{"index"=>{"_index"=>"appcolmobile-2019.03.29", "_type"=>"doc", "_id"=>"93Qey2kBYy1JgOfOb-jf", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse [response]", "caused_by"=>{"type"=>"illegal_state_exception", "reason"=>"Can't get text on a START_OBJECT at 1:601"}}}}}

You should not have quotes around convert. In recent versions that will get you a syntax error when parsing the configuration.

Leaving elasticsearch out of it, what do you want to see on stdout with a rubydebug output? It is not clear to me what you mean by array of strings. What do you want instead of

      "routes" => [
    [0] {
              "route" => "https://localhost:8443/auth/oauth/v2/token",
            "payload" => {
                     "clientId" => "a7dd9185-30c1-4119-bf6e-8e9460807a27",
            "colmobilePlatform" => "",
                        "susep" => "S5005J",
                          "cpf" => "11144477735",
             "colmobileVersion" => "",
                    "grantType" => "customCol"
        },
        "latencyTime" => "889",
             "status" => "200"
    }
],

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.