How to parser the json object dynamically in logstsh using ruby code

[Charan_Adabala]

I have this as input, I need to parse all the keys and values and put in a sperate event, can you please help me how to achive, Catually I'm only one key and value when I using the below ruby code.

"entities": {
"PROCESS_GROUP_INSTANCE-EA653E6874E21338": "WebSphere AS nzapwa145Cell (nzapwa146 / ePIMS_pwa146)",
"PROCESS_GROUP_INSTANCE-64A2967FB7FC0C5B": "WebSphere AS ndmProd (nzapwa127 / ePIMS_Report_pwa127)",
"PROCESS_GROUP_INSTANCE-4738C9392BDBC296": "EPS Store - 900008014",
"PROCESS_GROUP_INSTANCE-BA196B9B53FF6323": "EPS Store - 900008040",
"PROCESS_GROUP_INSTANCE-D5D2DAB06C8FDAAF": "ws-server.jar prod-sj-userprofile-adapter-service---*",
"PROCESS_GROUP_INSTANCE-3EABAD79933CE911": "/apps/conf/httpd-p2_cdis.conf - KPATHS",
}

Code:
ruby {
code => '
event.get("[result][entities]").each { |key, value|
event.set("hostId", key)
event.set("serverName", value)
}
'
}

Output for above code:
{"serverName":"/apps/conf/httpd-p2_cdis.conf - KPATHS)","@timestamp":"2018-08-25T15:17:11.762Z","hostId":"PROCESS_GROUP_INSTANCE-3EABAD79933CE911"}

But desired output will be like this :

{"serverName":"WebSphere AS nzapwa145Cell (nzapwa146 / ePIMS_pwa146)","@timestamp":"2018-08-25T15:17:11.762Z","hostId":"PROCESS_GROUP_INSTANCE-EA653E6874E21338"}
{"serverName":"WebSphere AS ndmProd (nzapwa127 / ePIMS_Report_pwa127)","@timestamp":"2018-08-25T15:17:11.762Z","hostId":"PROCESS_GROUP_INSTANCE-64A2967FB7FC0C5B"}
{"serverName":"EPS Store - 900008014","@timestamp":"2018-08-25T15:17:11.762Z","hostId":"PROCESS_GROUP_INSTANCE-4738C9392BDBC296"}
{"serverName":"ws-server.jar prod-sj-userprofile-adapter-service---*","@timestamp":"2018-08-25T15:17:11.762Z","hostId":"PROCESS_GROUP_INSTANCE-BA196B9B53FF6323"}
{"serverName":"/apps/conf/httpd-p2_cdis.conf - KPATHS","@timestamp":"2018-08-25T15:17:11.762Z","hostId":"PROCESS_GROUP_INSTANCE-D5D2DAB06C8FDAAF"}
{"serverName":"/apps/conf/httpd-p2_cdis.conf - KPATHS)","@timestamp":"2018-08-25T15:17:11.762Z","hostId":"PROCESS_GROUP_INSTANCE-3EABAD79933CE911"}

Can you please help me to get the solution, I'm facing problem with ruby code.

[Charan_Adabala]

Can you please help any one

[magnusbaeck (Magnus Bäck)]

You'll want to use the ruby code to produce an array field like this:

{
  "some-field": [
    {"serverName":"WebSphere AS nzapwa145Cell (nzapwa146 / ePIMS_pwa146)","@timestamp":"2018-08-25T15:17:11.762Z","hostId":"PROCESS_GROUP_INSTANCE-EA653E6874E21338"},
    {"serverName":"WebSphere AS ndmProd (nzapwa127 / ePIMS_Report_pwa127)","@timestamp":"2018-08-25T15:17:11.762Z","hostId":"PROCESS_GROUP_INSTANCE-64A2967FB7FC0C5B"},
    ...
  ]
}

Then you can use a split filter on the array field to put each the field in each array element into an event of its own.

[Charan_Adabala]

Can you please help how to produce an array for the above explanation, Please help me

[Charan_Adabala]

Can you help me please