Hi, 
I want both key and value from json using ruby in logstash, By using the belwo snippet, able to get only value not key. i need key also. Can you please help me:
Event: 
{"result":{"entities":{"HOST-B765":"apple"}}}
Snippet: 
ruby { 
code => ' 
hostId = "" 
serverName = "" 
event.get("[result][entities]").each { |x| 
x.each { |key, value| 
event.set("hostId", key) 
event.set("serverName", value) 
} 
} 
' 
} 
Output: 
{"hostId":"apple","serverName":null}
Desired Output:
{"hostId":"HOST-B765","serverName":"apple"}
Can any one please help me
             
            
               
               
               
            
            
           
          
            
              
                Badger  
                
               
              
                  
                    August 15, 2018, 11:38am
                   
                   
              2 
               
             
            
                      code => '
            event.get("[result][entities]").each { |k,v|
                event.set("hostId", k)
                event.set("serverName", v)
            }
        ' 
             
            
               
               
               
            
            
           
          
            
            
              Thanks for replying,
I have one more question can you please help me:
Input: 
{"result":{"dataPoints":{"HOST-B89B05174C5B9765":[[1531504800000,84.54410552978516],[1531526400000,99.29006958007812]}}}
Desired Output: 
{"dataPointTime":"1531504800000","dataPointValue":"84.54410552978516"} 
{"dataPointTime":"1531526400000","dataPointValue":"99.29006958007812"}
Can you please help me how to solve
             
            
               
               
               
            
            
           
          
            
              
                Badger  
                
               
              
                  
                    August 15, 2018,  1:57pm
                   
                   
              4 
               
             
            
              Do you mean you want to split  an event into two different events?
             
            
               
               
               
            
            
           
          
            
            
              Yeah I tried with ruby code but only last index value I'm getting
Tried like this :
ruby { 
code => ' 
dataPointTime = "" 
dataPointValue = "" 
dataPoints_size = event.get("[result][dataPoints][HOST-B89B05174C5B9765]").size 
dataPoints_size.times do |index| 
dataPointTime += event.get("[result][dataPoints][HOST-B89B05174C5B9765][#{index}][0]")+ "," 
dataPointValue += event.get("[result][dataPoints][HOST-B89B05174C5B9765][#{index}][1]")+ "," 
end 
event.set("dataPointTime", dataPointTime) 
event.set("dataPointValue", dataPointValue) 
' 
}
             
            
               
               
               
            
            
           
          
            
              
                Badger  
                
               
              
                  
                    August 15, 2018,  2:05pm
                   
                   
              6 
               
             
            
              You do not need to use ruby. You can use a mutate filter.
    split { field => "[result][dataPoints][HOST-B89B05174C5B9765]" }
    mutate { add_field => { "dataPointTime" => "%{[result][dataPoints][HOST-B89B05174C5B9765][0]}" } } 
             
            
               
               
               
            
            
           
          
            
            
              But I have around to 10 datapoints in the host, so I need to write dynamically. Can you please help me.
             
            
               
               
               
            
            
           
          
            
              
                system  
                (system)
                  Closed 
               
              
                  
                    September 12, 2018,  2:09pm
                   
                   
              8 
               
             
            
              This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.