How to write mutate for nested field as array in config file?

I have written the logstash config file to upload a csv,

filter {
	csv {
		separator => ","
		skip_header => true
		columns => [LoanID,Applicant_Income1,Occupation1,Time_At_Work1,Date_Of_Join1,Gender,LoanAmount,Marital_Status,Dependents,Education,Self_Employed,Applicant_Income2,Occupation2,Time_At_Work2,Date_Of_Join2,Applicant_Income3,Occupation3,Time_At_Work3,Date_Of_Join3]
	}
	mutate { 
		convert => {
			"Applicant_Income1" => "float"
			"Time_At_Work1" => "float"
			"LoanAmount" => "float"
			"Applicant_Income2" => "float"
			"Time_At_Work2" => "float"
			"Applicant_Income3" => "float"
			"Time_At_Work3" => "float"
			}
		} 
	mutate{
		rename => {
			"Applicant_Income1" => "[Applicant][0][Applicant_Income]"
			"Occupation1" => "[Applicant][0][Occupation]"
			"Time_At_Work1" => "[Applicant][0][Time_At_Work]"
			"Date_Of_Join1" => "[Applicant][0][Date_Of_Join]"
			"Applicant_Income2" => "[Applicant][1][Applicant_Income]"
			"Occupation2" => "[Applicant][1][Occupation]"
			"Time_At_Work2" => "[Applicant][1][Time_At_Work]"
			"Date_Of_Join2" => "[Applicant][1][Date_Of_Join]"
			"Applicant_Income3" => "[Applicant][2][Applicant_Income]"
			"Occupation3" => "[Applicant][2][Occupation]"
			"Time_At_Work3" => "[Applicant][2][Time_At_Work]"
			"Date_Of_Join3" => "[Applicant][2][Date_Of_Join]"
			}
		}	
    date {
        match => [ "Date_Of_Join1", "yyyy-MM-dd'T'HH:mm:ss.SSZZ" ]
        }	
    date {
        match => [ "Date_Of_Join2", "yyyy-MM-dd'T'HH:mm:ss.SSZZ" ]
      }	
    date {
        match => [ "Date_Of_Join3", "yyyy-MM-dd'T'HH:mm:ss.SSZZ" ]		
      }		  
	}

So i got as

image

I need the nested field to be an array of dictionaries.
like
image
Can i have help to write the config file, Thanks

You could do that using a ruby filter

ruby {
    code => '
        applicants = event.get("Applicant")
        a = []
        applicants.each { | k, v|
            a << v
        end
        event.set("Applicant", a)
   '
}

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.