How to convert to requried JSON

Hi,
Getting following logstash output

"rosterentry" : {
                "rosterdaterange" : [
                  "100,01-JUL-20,01-AUG-22",
                  "100,02-JUL-20,02-AUG-22",
                  "101,03-JUL-19,03-AUG-19"
                ],
                "rolerosterid" : [
                  "100",
                  "101"
                ]
              }

Output wanted to convert to below format

"rosterentry": [
                {
                    "rolerosterid": 100,
                    "rosterdaterange": [
                        {
                            "rolerosterstartdate": "2020-07-01-00:00",
                            "rolerosterenddate": "2022-08-01-00:00"
                        },
                        {
                            "rolerosterstartdate": "2021-07-01-00:00",
                            "rolerosterenddate": "2022-08-01-00:00"
                        }
                    ]
                },
                {
                    "rolerosterid": 101,
                    "rosterdaterange": [
                        {
                            "rolerosterstartdate": "2019-07-01-00:00",
                            "rolerosterenddate": "2019-08-01-00:00"
                        }
                    ]
                }
             ]

Logstash configuration file

filter {
	mutate {
		split => { "phone_no" => "," }
		split => { "rolerosterid" => "," }
		split => { "rosterdaterange" => "|" }

		# Remove unwanted ,, from rosterdaterange
		gsub => [ "rosterdaterange", ",," , "" ]

	}
	
	aggregate {
		task_id => "%{sch_id}"
		code => 
		"
			map['sch_id'] = event.get('sch_id') 
			
			map['teachers'] ||= [] 
			map['teachers'] << {
				'tch_id' => event.get('tch_id'),
				'contact_details'=> {
					'phone_no' => event.get('phone_no')
				},

				'rosterentry'=> {
					'rolerosterid' => event.get('rolerosterid'),
					'rosterdaterange'=> event.get('rosterdaterange'),
				}
			}
			event.cancel()
		"
	timeout_tags => ["aggregate"]
	push_previous_map_as_event => true
	timeout => 3
		
	} 
}

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.