How to use Ruby to preprocess k,v -pairs value

Elastic Stack Logstash
#1

Hi,
I`m new to Logstash and Ruby.
Would like to get help.
Currently I have a data as below

test:result testcase: #TEMP_BTWLAN:ok; loop:24;Temperature:28;

My initial target is by using ruby to generate as below Output.
test => result testcase
TEMP_BTWLAN => ok
loop => 24
Temperature => 28

Below is my code
#using kv to split the message
kv {
source => "message"
field_split => ";"
value_split => ":"
}

ruby {
code => "
hash = event.to_hash
hash.each { |key, value|
if value.include? '"'
event.set(key, value.gsub!('"', ''))
end
}
"
}

Output as below:
test => result testcase: #TEMP_BTWLAN:ok <== Problem
loop => 24
Temperature => 28

How to solve Problem that I stated above?

#2

Why is that a problem?

#3

I know the result is behave like this -> test => result testcase: #TEMP_BTWLAN:ok

But my expected result as below
test => result testcase
TEMP_BTWLAN => ok

Would like to get advise, how to perform second layer split by using ruby in order to meet my expected result?

#4

hi,

Did you have tried to put a ; after testcase in your log ?
You can, if ou want, use grok :

(?<key1>[^:]+):(?<value1>[^:]+):%{SPACE}#(?<key2>[^:]+):(?<value2>[^;]+);%{SPACE}(?<key3>[^:]+):(?<value3>[^;]+);%{SPACE}(?<key4>[^:]+):(?<value4>[^;]+);

Cad

#5

Hi Cad,

Log Output ==> test:result testcase: #TEMP_BTWLAN:ok; loop:24;Temperature:28;

This log output is fixed which i not allowed to change.
The example you show is kv for grok?

#6

Hi,

This is my interpretation for kv. I don't know how the syntaxe is analysed but we can create a grok pattern with the same result.

This grok pattern signification is :
(?<key>[^:]+): = take all caracter while it is not a :, put it in "key" and after take :.
(?<value>[^;]+); = take all caracter while it is not a ;, put it in "value" and after take ;.

So you just have to duplicate this two pattern as many time as necessary.

Cad