Joining JSON Array Values

Elastic Stack Logstash
1

I have data coming in as JSON structured like below. The JSON is parsed and the data under Charlie is displayed as an array of JSON. I'd like to concatenate all the values in URL to a single field, but can't seem to figure out how to do that. Should I run charlie through JSON again and then use mutate to join them?

{
	"Alpha": {
		"Bravo": {
			"Charlie": [
				{
					"url": "1",
					"name": "1"
					]
				},
				{
					"url": "2",
					"name": "2"
					]
				},
				{
					"url": "3",
					"name": "3"
					]
				},
				{
					"url": "4",
					"name": "4",
					]
				}
			]
		}
	}
}
2

You want to end up with the string "1234"?

3

Yes, that's correct.

4

Try

ruby {
    code => '
        c = event.get("[Alpha][Bravo][Charlie]")
        if c.is_a? Array
            s = ""
            c.each { |x|
                s += x["url"]
            }
            event.set("someField", s)
        end
    '
}
5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.