How to iterate through several elements and create a new field with the content of each element

Elastic Stack Logstash
1

My Logstash receive of a http input this field

PANELS.memory {
"availableBytes": 6212550656,
"totalBytes": 8493137920,
"type": "physical"
},
{
"availableBytes": 14702407680,
"totalBytes": 17256087552,
"type": "virtual"
}

If I split this field, it will save 2 (or more) different elasticsearch documents, but I need to save 1 only elasticsearch document of the form:

PANELS.memory0 {
"availableBytes": 6212550656,
"totalBytes": 8493137920,
"type": "physical"
},
PANELS.memory1 {
"availableBytes": 14702407680,
"totalBytes": 17256087552,
"type": "virtual"
}
PANELS.memoryN {
"availableBytes": 14702407680,
"totalBytes": 17256087552,
"type": "cache"
}

I tried to create a ruby filter to iterate on "n" elements (if applicable) but I don't know enough ruby to solve the problem.

I really appreciate your support

In the label JSON, the field looks like this:

"PANELS": {
      "memory": [
    {
      "availableBytes": 6211796992,
      "type": "physical",
      "totalBytes": 8493137920
    },
    {
      "availableBytes": 14701268992,
      "type": "virtual",
      "totalBytes": 17256087552
    },
    {
      "availableBytes": 6211796992,
      "type": "cache",
      "totalBytes": 8493137920
    }
  ],

}

2

You could try something similar to this.

3

Thanks @Badger, I used this code of @adrianolimit and solve the problem.

The ruby filter is a powerfull and needed tool.

Thanks.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.