Hi,
I want both key and value from json using ruby in logstash, By using the belwo snippet, able to get only value not key. i need key also. Can you please help me:
Event:
{"result":{"entities":{"HOST-B765":"apple"}}}
Snippet:
ruby {
code => '
hostId = ""
serverName = ""
event.get("[result][entities]").each { |x|
x.each { |key, value|
event.set("hostId", key)
event.set("serverName", value)
}
}
'
}
Output:
{"hostId":"apple","serverName":null}
Desired Output:
{"hostId":"HOST-B765","serverName":"apple"}
Can any one please help me
Badger
August 15, 2018, 11:38am
2
code => '
event.get("[result][entities]").each { |k,v|
event.set("hostId", k)
event.set("serverName", v)
}
'
Thanks for replying,
I have one more question can you please help me:
Input:
{"result":{"dataPoints":{"HOST-B89B05174C5B9765":[[1531504800000,84.54410552978516],[1531526400000,99.29006958007812]}}}
Desired Output:
{"dataPointTime":"1531504800000","dataPointValue":"84.54410552978516"}
{"dataPointTime":"1531526400000","dataPointValue":"99.29006958007812"}
Can you please help me how to solve
Badger
August 15, 2018, 1:57pm
4
Do you mean you want to split an event into two different events?
Yeah I tried with ruby code but only last index value I'm getting
Tried like this :
ruby {
code => '
dataPointTime = ""
dataPointValue = ""
dataPoints_size = event.get("[result][dataPoints][HOST-B89B05174C5B9765]").size
dataPoints_size.times do |index|
dataPointTime += event.get("[result][dataPoints][HOST-B89B05174C5B9765][#{index}][0]")+ ","
dataPointValue += event.get("[result][dataPoints][HOST-B89B05174C5B9765][#{index}][1]")+ ","
end
event.set("dataPointTime", dataPointTime)
event.set("dataPointValue", dataPointValue)
'
}
Badger
August 15, 2018, 2:05pm
6
You do not need to use ruby. You can use a mutate filter.
split { field => "[result][dataPoints][HOST-B89B05174C5B9765]" }
mutate { add_field => { "dataPointTime" => "%{[result][dataPoints][HOST-B89B05174C5B9765][0]}" } }
But I have around to 10 datapoints in the host, so I need to write dynamically. Can you please help me.
system
(system)
Closed
September 12, 2018, 2:09pm
8
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.