Jdbc_streaming and mutate

[Roberto_B]

Hi Friends,

I use a jdbc_streaming filter in order to enrich data.
This filter produces an array with only 1 document inside. How can I pop out this document in another field? I tried without success with ruby code.
Just to do an example:
This is the final output:

"reg_pro_com" : [
                {
                        "nomeR" : "Sicilia",
                        "nomeC" : "Ragusa",
                        "nomeP" : "Ragusa"
                }
        ],

I wish to have:

"reg_pro_com" : {
                        "nomeR" : "Sicilia",
                        "nomeC" : "Ragusa",
                        "nomeP" : "Ragusa"
                           }
      

I have to use add_field? How can I access the array without Ruby Code?

KR

Roberto

[aaron-nimocks]

This might give you what you are looking for.

 mutate {
  update => { "reg_pro_com" => "%{[reg_pro_com][0]}" }
 }

Output

"reg_pro_com": "{\"nomeC\":\"Ragusa\",\"nomeP\":\"Ragusa\",\"nomeR\":\"Sicilia\"}"

[Roberto_B]

but it a string not a subdocument, I need a subdocument.

[Badger]

If mutate does not do what you want (although I think it will) you could use a split filter.

[Roberto_B]

Found a solution: (thanks aaron-nimocks for the first step):

mutate {
update => { "reg_pro_com" => "%{[reg_pro_com][0]}" }
}
json {
source => "reg_pro_com"
target => "reg_pro_com2"
}
mutate{
remove_field => ["reg_pro_com"]
rename=> {"reg_pro_com2"=>"reg_pro_com"}
}