Hi,
Getting following logstash output
"rosterentry" : {
"rosterdaterange" : [
"100,01-JUL-20,01-AUG-22",
"100,02-JUL-20,02-AUG-22",
"101,03-JUL-19,03-AUG-19"
],
"rolerosterid" : [
"100",
"101"
]
}
Output wanted to convert to below format
"rosterentry": [
{
"rolerosterid": 100,
"rosterdaterange": [
{
"rolerosterstartdate": "2020-07-01-00:00",
"rolerosterenddate": "2022-08-01-00:00"
},
{
"rolerosterstartdate": "2021-07-01-00:00",
"rolerosterenddate": "2022-08-01-00:00"
}
]
},
{
"rolerosterid": 101,
"rosterdaterange": [
{
"rolerosterstartdate": "2019-07-01-00:00",
"rolerosterenddate": "2019-08-01-00:00"
}
]
}
]
Logstash configuration file
filter {
mutate {
split => { "phone_no" => "," }
split => { "rolerosterid" => "," }
split => { "rosterdaterange" => "|" }
# Remove unwanted ,, from rosterdaterange
gsub => [ "rosterdaterange", ",," , "" ]
}
aggregate {
task_id => "%{sch_id}"
code =>
"
map['sch_id'] = event.get('sch_id')
map['teachers'] ||= []
map['teachers'] << {
'tch_id' => event.get('tch_id'),
'contact_details'=> {
'phone_no' => event.get('phone_no')
},
'rosterentry'=> {
'rolerosterid' => event.get('rolerosterid'),
'rosterdaterange'=> event.get('rosterdaterange'),
}
}
event.cancel()
"
timeout_tags => ["aggregate"]
push_previous_map_as_event => true
timeout => 3
}
}