How to use ruby filter


#1

My problem is specific as below.

the event message is:

   {"a":[{"aa":"v1"},{"bb":"v2"}]}

how to add a field ,namely, "a_size" and its value is array a's length. so the output is like below:

{"a":[{"aa":"v1"},{"bb":"v2"}],"a_size":2 }


(Magnus B├Ąck) #2
filter {
  ruby {
    code => "event['a_size'] = event['a'].length"
  }
}

(You should wrap the filter in a conditional so you don't attempt this if the a field doesn't exist.)


(system) #3