Json field parsing , multi value field

Elastic Stack Logstash
1

I want to parse json message . I am using add_field option as i do not need all fields from the message.

landingPlatformCode field has mutiple values . given bellow exmample to pull first value. There might be 1 ,2 ,3 4,5 values or just one value in this field.

if [EventStreamData][response][landingURL][0][landingPlatformCode] {
mutate { add_field => {"landingPlatformCode" => "%{[EventStreamData][response][landingURL][0][landingPlatformCode]}" } }
}

Want to use ruby code to loop through this field values

   if [EventStreamData][response][landingURL] {
    ruby {
    code => "
    event[EventStreamData][response][landingURL].each { |kv|
    event[kv['key']] = kv['value'] unless kv['value'].nil?
    mutate { add_field => {"landingPlatformCode" => "%{[EventStreamData][response][landingURL][0][landingPlatformCode]}" } }
    }
    "
    }

This roby code does not work. Please suggest how can modify this code to work for just one of the field with mutiple key value pairs.

2

Which version of Logstash is this? What does an example input message look like?

You can't put a mutate filter inside your ruby filter's code block.

3

Logstash version is 5.5

Sample test log . End of the message has landingURL with multiple values.

{"StreamMessageContext":{"app":"Test","serverIP":"10.207.170.38","instanceName":"defaultDomain","correlationId":"EAS-AND-F0BBDC86-ED3A-4B62-8A49-FC3088B83C9C"},"EventStreamData":{"status":1,"httpStatus":200,"dispositionCode":1,"eventName":"5000027","requestContext":{"pragmaNoStore":false,"requestCookies":[],"vipUrlHostPortPrefix":"http://api-it.cloud.example.com:443","policyDecisionPoint":"eAPI_PDP","oauth2ResourceOwnerUID":"UNDEFINED","pragmaNoCache":true,"userId":"ANONYMOUS","rsaCorrelationId":"UNDEFINED","eventEndTime":"2017-08-08 13:20:11.663 +00:00","clientIP":"10.207.170.38","eventStartTime":"2017-08-08 13:20:11.182 +00:00","webAnalyticsCorrelationId":"|","applicationCode":"ISSO","domainName":"defaultDomain","correlationId":"EAS-AND-F0BBDC86-ED3A-4B62-8A49-FC3088B83C9C","applicationName":"customers-logins-app","allRequestHeaders":{"accept":["application/json;v=4"],"accept-encoding":["gzip"],"accept-language":["en-us"],"api-key":["MOBILE"],"cache-control":["no-cache"],"channel-type":["MOBILE"],"client-correlation-id":["EAS-AND-F0BBDC86-ED3A-4B62-8A49-FC3088B83C9C"],"client-ip":["10.207.45.231"],"client_id":["0cdca3b725074d359841e1f9a067d29b"],"connection":["keep-alive"],"content-length":["2500"],"content-type":["application/json"],"correlation-id":["F0BBDC86-ED3A-4B62-8A49-FC3088B83C9C"],"country-code":["US"],"ct_request_id":["82152"],"customer-ip-address":["10.207.45.231"],"device-id":["774random7device2id4"],"edge-context-id":["396334eb-4cea-4990-9517-a2824a932609"],"endpoint_id":["6617a32ac9e24ef6b4eee3bb3686a134"],"forwarded":["for=10.207.32.121;proto=https;host:443=api-it.cloud.example.com"],"host":["it.example.com"],"pragma":["no-cache"],"user-agent":["Dalvik/2.1.0 (Linux; U; Android 5.1; XT1032 Build/LMY47M.M005)"],"x-apigw-app-id":["9d95ebde6aa64208a45b0c4b5bc6b944"],"x-apigw-key":["CapiOne-IT-INT-10.207.175.150"],"x-apigw-origin-client-id":["0cdca3b725074d359841e1f9a067d29b"],"x-apigw-resolved-upstream-env":["QA"],"x-apigw-upstream-backend-id":["9562ad1a-4cf8-4e4b-9e17-0e62741577c7"],"x-client-id":["0cdca3b725074d359841e1f9a067d29b"],"x-forwarded-cn":["rtmqa-client.example.com"],"x-forwarded-for":["10.207.45.231, 10.207.55.131, 10.207.32.121, 10.207.175.150"],"x-forwarded-host":["api-it.cloud.example.com"],"x-forwarded-port":["443"],"x-forwarded-proto":["https"],"x-forwarded-server":["Mobile-e-qa-cr-mobile-ip-10-207-53-103.dqa.example.com"],"x-message-id":["10.207.175.150-c823e8a4-9dd7-4a0e-a303-8d3d1ef34670","10.207.175.150-c823e8a4-9dd7-4a0e-a303-8d3d1ef34670"],"x-newrelic-id":["UAUGV1JRGwEEV1hQAgg="],"x-real-ip":["10.207.32.121"]},"locale":"en_US","messageId":"10.207.175.150-c823e8a4-9dd7-4a0e-a303-8d3d1ef34670","notNull":true},"args":{"customerLoginRequest":{"username":"Bx5sJaLDNFMcrUOp7bENhTNeXyOZFte+kkPhw5uoiKoMWQIQwd+C5d0edJ6d0kczKl8UfpzgjIptHxJ9c7wU8H/9aKnO4WSq1lRayD72anbYPjuHYFOsYqNJWdwnBvpImp+b+BkKBlwN8SyoklR2b0znwNWa1XKsuJka77Yb5jc=","authenticationMethod":"Password","authenticationMode":"Authenticate","device":{"authenticationDeviceId":"hO9MgzRiAycCZgacosGV3Z+kGlVAR8HxLmGL2p4VXwXVzeQYuyanyfRAFJ8DTxqU2jqSqp7ndxJ6fLJdNSzAAD8VgYpIZ3nsE9baEWECRxLFoX2glB2WM7FuLfr7+tMCR6JRvkn1V36AOuG9XtdCRy5mc81tdvIiEeoXk8WtB5kJDtMSrzp4xU3bCV1GfLz3FuEdsFLk/8nyKRITwel13esYXdbMFj6mMaBCK7+/4ovwALi2i4AgGx0OoRoCrafq0qy76JZdMFVoLwCN7jHW/7w1PbjtYKnMGwASIjZR/14I/KhkdXK9+RZ3hIIds0EGRGP2RvJWxoDnoFXmHtDvaA==","deviceModel":"XT1032","devicePlatform":"android","deviceType":"Android","deviceOperatingSystem":"android","deviceOperatingSystemVersion":"5.1","deviceNickname":"falcon_umts","appName":"com.capitalone.mobilebanking.dev.debug","appVersion":"1613230500","appEnvironment":"android"},"riskAssessment":{"mobile":{"mobileSdkInfo":"{"TIMESTAMP":"2016-08-17T15:24:37Z","HardwareID":"359278059115484","DeviceModel":"XT1032","MultitaskingSupported":true,"DeviceName":"falcon_umts","DeviceSystemName":"Android","DeviceSystemVersion":"22","Languages":"en","WiFiMacAddress":"14:30:c6:f4:a6:24","ScreenSize":"720x1184","RSA_ApplicationKey":"155DF45852AC5535347F2CCF9B9D02DF","OS_ID":"774random7device2id4","SDK_VERSION":"2.0.1","Compromised":0,"Emulator":0,"OperatorName":"","OperatorCode":"","OperatorISO":"","SimCountryCode":"","SimOperator":""}","deviceSdkInfo":"{"TIMESTAMP":"2016-08-17T15:24:37Z","HardwareID":"359278059115484","DeviceModel":"XT1032","MultitaskingSupported":true,"DeviceName":"falcon_umts","DeviceSystemName":"Android","DeviceSystemVersion":"22","Languages":"en","WiFiMacAddress":"14:30:c6:f4:a6:24","ScreenSize":"720x1184","OS_ID":"774random7device2id4","SDK_VERSION":"1.0.0","Compromised":0,"Emulator":0,"OperatorName":"","OperatorCode":"","OperatorISO":"","SimCountryCode":"","SimOperator":""}","universalDeviceIdentifier":"774random7device2id4"}},"sessionId":"EAS-AND-F0BBDC86-ED3A-4B62-8A49-FC3088B83C9C"}},"response":{"profileReferenceId":"4dWFRyIdC188NMLK+tMB3NKEgRrHO1f556/y0pEiwuIm1nBkLzSj6HountD4y8ve","platforms":[{"platformCode":"Test1"},{"platformCode":"Test2"},{"platformCode":"Test3"},{"platformCode":"Test4"},{"platformCode":"Test5"}],"landingURL":[{"landingPlatformCode":"AVAILABLE_PRODUCTS","landingPlatformURL":"https://verified-it.example.com/sic-ui/#/pathFinder"},{"landingPlatformCode":"360BANK","landingPlatformURL":"https://secure-qa2.int.example360qa.com/myaccount/banking/postlogin"},{"landingPlatformCode":"CTRACKER","landingPlatformURL":"https://preprod-creditwise.example.com/#/authenticated"},{"landingPlatformCode":"CARD","landingPlatformURL":"https://cosqa4.example.com/accounts/?initial_login=true"},{"landingPlatformCode":"OLBANK","landingPlatformURL":"https://olbrqa5.example.com/olb-web/entry"}],"loginStatus":"SUCCESS","ssoId":"310d8fdc98b647f5d9f8c3d831a28892","mobileOnly":false}}}

4

Please post the JSON blob as preformatted text so it doesn't get mangled. I don't want to waste time fixing the broken JSON just to be able to read it properly and see its structure.

1 Like
5

{"StreamMessageContext":{"appName":"ISSO","serverIP":"10.207.169.114","instanceName":"defaultDomain","correlationId":"EAS-AND-raj"},"EventStreamData":{"status":1,"httpStatus":200,"dispositionCode":1,"eventName":"5000027","requestContext":{"pragmaNoCache":true,"pragmaNoStore":false,"requestCookies":[],"policyDecisionPoint":"eAPI_PDP","eventEndTime":"2017-08-17 17:10:21.309 +00:00","oauth2ResourceOwnerUID":"UNDEFINED","rsaCorrelationId":"UNDEFINED","vipUrlHostPortPrefix":"http://api-it.cloud.exampleone.com:443","applicationCode":"ISSO","webAnalyticsCorrelationId":"|","eventStartTime":"2017-08-17 17:10:20.894 +00:00","correlationId":"EAS-AND-raj","applicationName":"customers-logins-app","allRequestHeaders":{"accept":["application/json;v=4"],"accept-encoding":["gzip"],"accept-language":["en-US"],"accept-type":["application/json"],"api-key":["MOBILE"],"app-auth-token":["ZXlKaGJHY2lPaUpCTVRJNFMxY2lMQ0psYm1NaU9pSkJNVEk0UTBKRExVaFRNalUySW4wLlVtc19qTFhKTzVUMTBLNzRYb2dWN1VUVXpLRTVxdUxjbjR5dFFlUnAzUkhBMDVCVERiWV9xdy54SjU5LVBmNHBLNm5yWldhQ2xkUkpBLjR1VTE1cWEtSDFCWUFkNE1QeFBZWGxfUlJ3NnFFOURZaVNNbjJsejNuU0N6d1pmN0hLMnJFdXRIMUhLLXcxeWhfeFhJdmQ3eUIyTlRXT2NYM0xxb0l5S1JNUzRpSkpSTnJ2RnlsOFRnSnhTbm1ueVFiblZsWGJuTWVGLTRwQWdEOVZIUU1XLXZvbDBCVF81ZE1HTlRrNHRyRWNZWXFyNDN1QjR0aVlGS2RDSF9HU3JwT1V4NVIydVhLWEpKbnh6LVpaMC1YN2p4QU5nY3ktNTVrWFk2VEQyZDE3cTdiMmVCVktveHZlb2NoSVFISVQ4RElYMG44bXlHTmpQODNRN2hMUEJaV3V0ZGFZMF9WZVBuU2d0bzlDVFpMcjlxNElGdlVQVzBQTGhOemtLWl92eUJaa0lqLWRCcE16QlVPcGFBLWxzQXMzTGtHWC1WOUVsUkY2NzU4dy5MWm1fRE8yVW1tcGtqNE1xR29KZmhR"],"cache-control":["no-cache"],"channel-type":["MOBILE"],"client-correlation-id":["EAS-AND-raj"],"client-ip":["10.212.113.158"],"client_id":["0cdca3b725074d359841e1f9a067d29b"],"connection":["keep-alive"],"content-length":["2066"],"content-type":["application/json"],"country-code":["US"],"ct_request_id":["18198"],"customer-ip-address":["10.212.113.158"],"device-id":["6b7d17e26ef315a8"],"edge-context-id":["1e6da2dc-706c-4349-8e95-7190177c4578"],"endpoint_id":["6617a32ac9e24ef6b4eee3bb3686a134"],"forwarded":["for=10.207.33.20;proto=https;host:443=api-it.cloud.exampleone.com"],"host":["sicapis-ite.clouddqt.exampleone.com"],"user-agent":["rest-client/2.0.2 (darwin13.4.0 x86_64) ruby/2.2.2p95"],"x-apigw-app-id":["9d95ebde6aa64208a45b0c4b5bc6b944"],"x-apigw-key":["CapiOne-IT-INT-10.207.160.157"],"x-apigw-origin-client-id":["0cdca3b725074d359841e1f9a067d29b"],"x-apigw-resolved-upstream-env":["QA"],"x-apigw-upstream-backend-id":["9562ad1a-4cf8-4e4b-9e17-0e62741577c7"],"x-client-id":["0cdca3b725074d359841e1f9a067d29b"],"x-forwarded-cn":["rtmqa-client.xyz.exampleone.com"],"x-forwarded-for":["10.212.113.158, 10.212.113.110, 10.207.55.131, 10.207.33.20, 10.207.160.157"],"x-forwarded-host":["api-it.cloud.exampleone.com"],"x-forwarded-port":["443"],"x-forwarded-proto":["https"],"x-forwarded-server":["Mobile-e-qa-cr-mobile-ip-10-207-39-117.dqa.exampleone.com"],"x-message-id":["10.207.160.157-5cdc90cc-3a0a-4558-baa7-d5ead2d237db","10.207.160.157-5cdc90cc-3a0a-4558-baa7-d5ead2d237db"],"x-real-ip":["10.207.33.20"]},"userId":"ANONYMOUS","domainName":"defaultDomain","clientIP":"10.207.169.114","locale":"en_US","notNull":true,"messageId":"10.207.160.157-5cdc90cc-3a0a-4558-baa7-d5ead2d237db"},"args":{"customerLoginRequest":{"username":"LxVt+q2xu9IxB45k1y5ro2/GejqkajDqHcz0sNoCbPnyodEkfS0ZafmG/RsdWjBTZS8Uj4rtypsWnslbHnJaQUaWJcnpPFIGtIkrV9UsDBRNcypw+vtmnt1hSQR5V/V47J7WUNGj7CzVna+2qfOVrQLJeoEPt52XpjS/99h/Qp7RAjlstaPjFD0uvNIFt/pzSjckne7ZRyazCjVzI7cukZy9OQjGRHTQoVpQ1XnI5gXDsGyfzNnYL1kAIu4aUdQ6zj2ZdmDDIW2/2bWG1O5umMF7L17+O5jkgGtxqmlG6oHGD9qtRkkxQywmHkARzpaE0LfbWjGBdGKPlu5k2Enj8A==","authenticationMethod":"Password","authenticationMode":"AUTHENTICATE","device":{"authenticationDeviceId":"vszUyrQzY84IUm3RfIxPWdakysjEecl201McNBK3b3sK2B+zXAIhNUvaObWlc2DDtm1K81QlmoxkMI5UUuHCqkIPcaU5eWVbDu6MPHNEmV63kdNqSHi8ye8Mvmb5d7YhZyi2bC+6bS0bs6BhlYYPCPN/iW4GI6KNW8HF+CjIGWIqek/Cb5RHcHlCDfLeq/ODfPj1WOB83KCMqo7SfVjiEPWXgLmCBIY7OzodXLk9nInVEWf6jUZ8zNYRQEYYV+fYgPJvJP3PIA87wtU0x/MfGbt1Ctk8WdBVMWlPrX6WdOoBwTsgftZDCJ0HGfd7dGWaDDpQURphbB0A6xU8Yh7Jlg==","deviceModel":"iPad2","devicePlatform":"iPad","deviceType":"iPhone","deviceOperatingSystem":"ios","deviceOperatingSystemVersion":"7","deviceNickname":"PersonalIPad","appName":"Wallet","appVersion":"1.0.0","appEnvironment":"ios"},"riskAssessment":{"mobile":{"phoneNumber":"2134071411","mobileSdkInfo":"{ "DeviceSystemVersion" : "9.0.2", "HardwareID" : "4D2DA09D666D4BB6ADCB42476F925C3C", "ScreenSize" : "375 x 667", "Languages" : "en-US", "MultitaskingSupported" : true, "DeviceModel" : "iPhone", "RSA_ApplicationKey" : "50A77F047BDCDA73EC511CD5337004C8", "WiFiMACAddress" : "4D2DA09D666D4BB6ADCB42476F925C3C", "TIMESTAMP" : "2015-10-09T19:35:52Z", "Emulator" : 0, "OtherId" : "4D2DA09D-666D-4BB6-ADCB-42476F925C3C", "OS_ID" : "00F6B812-4D96-4DFC-B6EF-A4B455017E78", "Compromised" : 0, "DeviceSystemName" : "iPhone OS", "DeviceName" : "iPhone (5)", "SDK_VERSION" : "2.0.1" }","simId":"12122","universalDeviceIdentifier":"1D4031AB-0DD4-4699-952A-08688CFF"}},"signInPlatform":"EOS","sessionId":"EAS-AND-raj"}},"response":{"profileReferenceId":"9vX84mj85yu79fg/sHRhKmrFhN0Px+dk9EO8o+Ia8q5IUDx6CGaUHaXRhkE9KVEn","platforms":[{"platformCode":"360"},{"platformCode":"EASE"},{"platformCode":"EOS"}],"landingURL":[{"landingPlatformCode":"AVAILABLE_PRODUCTS","landingPlatformURL":"https://verified-it.exampleone.com/sic-ui/#/pathFinder"},{"landingPlatformCode":"360BANK","landingPlatformURL":"https://secure-qa2.int.exampleone360qa.com/myaccount/banking/postlogin"},{"landingPlatformCode":"CARD","landingPlatformURL":"https://cosqa4.xyz.exampleone.com/accounts/?initial_login=true"}],"loginStatus":"CHALLENGE","ssoId":"df2dae743fda82fb804e97dcd27eb2b3","mobileOnly":false}}}Preformatted text

6

Please let me know if you can see this message properly .

7

Still not right. Just put

```

(three backticks) before and after the JSON text or use the </> toolbar button. This isn't rocket science.

8

{"StreamMessageContext":{"appName":"ISSO","serverIP":"10.207.169.114","instanceName":"defaultDomain","correlationId":"EAS-AND-raj"},"EventStreamData":{"status":1,"httpStatus":200,"dispositionCode":1,"eventName":"5000027","requestContext":{"pragmaNoCache":true,"pragmaNoStore":false,"requestCookies":[],"policyDecisionPoint":"eAPI_PDP","eventEndTime":"2017-08-17 17:10:21.309 +00:00","oauth2ResourceOwnerUID":"UNDEFINED","rsaCorrelationId":"UNDEFINED","vipUrlHostPortPrefix":"http://api-it.cloud.exampleone.com:443","applicationCode":"ISSO","webAnalyticsCorrelationId":"|","eventStartTime":"2017-08-17 17:10:20.894 +00:00","correlationId":"EAS-AND-raj","applicationName":"customers-logins-app","allRequestHeaders":{"accept":["application/json;v=4"],"accept-encoding":["gzip"],"accept-language":["en-US"],"accept-type":["application/json"],"api-key":["MOBILE"],"app-auth-token":["ZXlKaGJHY2lPaUpCTVRJNFMxY2lMQ0psYm1NaU9pSkJNVEk0UTBKRExVaFRNalUySW4wLlVtc19qTFhKTzVUMTBLNzRYb2dWN1VUVXpLRTVxdUxjbjR5dFFlUnAzUkhBMDVCVERiWV9xdy54SjU5LVBmNHBLNm5yWldhQ2xkUkpBLjR1VTE1cWEtSDFCWUFkNE1QeFBZWGxfUlJ3NnFFOURZaVNNbjJsejNuU0N6d1pmN0hLMnJFdXRIMUhLLXcxeWhfeFhJdmQ3eUIyTlRXT2NYM0xxb0l5S1JNUzRpSkpSTnJ2RnlsOFRnSnhTbm1ueVFiblZsWGJuTWVGLTRwQWdEOVZIUU1XLXZvbDBCVF81ZE1HTlRrNHRyRWNZWXFyNDN1QjR0aVlGS2RDSF9HU3JwT1V4NVIydVhLWEpKbnh6LVpaMC1YN2p4QU5nY3ktNTVrWFk2VEQyZDE3cTdiMmVCVktveHZlb2NoSVFISVQ4RElYMG44bXlHTmpQODNRN2hMUEJaV3V0ZGFZMF9WZVBuU2d0bzlDVFpMcjlxNElGdlVQVzBQTGhOemtLWl92eUJaa0lqLWRCcE16QlVPcGFBLWxzQXMzTGtHWC1WOUVsUkY2NzU4dy5MWm1fRE8yVW1tcGtqNE1xR29KZmhR"],"cache-control":["no-cache"],"channel-type":["MOBILE"],"client-correlation-id":["EAS-AND-raj"],"client-ip":["10.212.113.158"],"client_id":["0cdca3b725074d359841e1f9a067d29b"],"connection":["keep-alive"],"content-length":["2066"],"content-type":["application/json"],"country-code":["US"],"ct_request_id":["18198"],"customer-ip-address":["10.212.113.158"],"device-id":["6b7d17e26ef315a8"],"edge-context-id":["1e6da2dc-706c-4349-8e95-7190177c4578"],"endpoint_id":["6617a32ac9e24ef6b4eee3bb3686a134"],"forwarded":["for=10.207.33.20;proto=https;host=api-it.cloud.exampleone.com:443"],"host":["sicapis-ite.clouddqt.exampleone.com"],"user-agent":["rest-client/2.0.2 (darwin13.4.0 x86_64) ruby/2.2.2p95"],"x-apigw-app-id":["9d95ebde6aa64208a45b0c4b5bc6b944"],"x-apigw-key":["CapiOne-IT-INT-10.207.160.157"],"x-apigw-origin-client-id":["0cdca3b725074d359841e1f9a067d29b"],"x-apigw-resolved-upstream-env":["QA"],"x-apigw-upstream-backend-id":["9562ad1a-4cf8-4e4b-9e17-0e62741577c7"],"x-client-id":["0cdca3b725074d359841e1f9a067d29b"],"x-forwarded-cn":["rtmqa-client.xyz.exampleone.com"],"x-forwarded-for":["10.212.113.158, 10.212.113.110, 10.207.55.131, 10.207.33.20, 10.207.160.157"],"x-forwarded-host":["api-it.cloud.exampleone.com"],"x-forwarded-port":["443"],"x-forwarded-proto":["https"],"x-forwarded-server":["Mobile-e-qa-cr-mobile-ip-10-207-39-117.dqa.exampleone.com"],"x-message-id":["10.207.160.157-5cdc90cc-3a0a-4558-baa7-d5ead2d237db","10.207.160.157-5cdc90cc-3a0a-4558-baa7-d5ead2d237db"],"x-real-ip":["10.207.33.20"]},"userId":"ANONYMOUS","domainName":"defaultDomain","clientIP":"10.207.169.114","locale":"en_US","notNull":true,"messageId":"10.207.160.157-5cdc90cc-3a0a-4558-baa7-d5ead2d237db"},"args":{"customerLoginRequest":{"username":"LxVt+q2xu9IxB45k1y5ro2/GejqkajDqHcz0sNoCbPnyodEkfS0ZafmG/RsdWjBTZS8Uj4rtypsWnslbHnJaQUaWJcnpPFIGtIkrV9UsDBRNcypw+vtmnt1hSQR5V/V47J7WUNGj7CzVna+2qfOVrQLJeoEPt52XpjS/99h/Qp7RAjlstaPjFD0uvNIFt/pzSjckne7ZRyazCjVzI7cukZy9OQjGRHTQoVpQ1XnI5gXDsGyfzNnYL1kAIu4aUdQ6zj2ZdmDDIW2/2bWG1O5umMF7L17+O5jkgGtxqmlG6oHGD9qtRkkxQywmHkARzpaE0LfbWjGBdGKPlu5k2Enj8A==","authenticationMethod":"Password","authenticationMode":"AUTHENTICATE","device":{"authenticationDeviceId":"vszUyrQzY84IUm3RfIxPWdakysjEecl201McNBK3b3sK2B+zXAIhNUvaObWlc2DDtm1K81QlmoxkMI5UUuHCqkIPcaU5eWVbDu6MPHNEmV63kdNqSHi8ye8Mvmb5d7YhZyi2bC+6bS0bs6BhlYYPCPN/iW4GI6KNW8HF+CjIGWIqek/Cb5RHcHlCDfLeq/ODfPj1WOB83KCMqo7SfVjiEPWXgLmCBIY7OzodXLk9nInVEWf6jUZ8zNYRQEYYV+fYgPJvJP3PIA87wtU0x/MfGbt1Ctk8WdBVMWlPrX6WdOoBwTsgftZDCJ0HGfd7dGWaDDpQURphbB0A6xU8Yh7Jlg==","deviceModel":"iPad2","devicePlatform":"iPad","deviceType":"iPhone","deviceOperatingSystem":"ios","deviceOperatingSystemVersion":"7","deviceNickname":"PersonalIPad","appName":"Wallet","appVersion":"1.0.0","appEnvironment":"ios"},"riskAssessment":{"mobile":{"phoneNumber":"2134071411","mobileSdkInfo":"{ \"DeviceSystemVersion\" : \"9.0.2\", \"HardwareID\" : \"4D2DA09D666D4BB6ADCB42476F925C3C\", \"ScreenSize\" : \"375 x 667\", \"Languages\" : \"en-US\", \"MultitaskingSupported\" : true, \"DeviceModel\" : \"iPhone\", \"RSA_ApplicationKey\" : \"50A77F047BDCDA73EC511CD5337004C8\", \"WiFiMACAddress\" : \"4D2DA09D666D4BB6ADCB42476F925C3C\", \"TIMESTAMP\" : \"2015-10-09T19:35:52Z\", \"Emulator\" : 0, \"OtherId\" : \"4D2DA09D-666D-4BB6-ADCB-42476F925C3C\", \"OS_ID\" : \"00F6B812-4D96-4DFC-B6EF-A4B455017E78\", \"Compromised\" : 0, \"DeviceSystemName\" : \"iPhone OS\", \"DeviceName\" : \"iPhone (5)\", \"SDK_VERSION\" : \"2.0.1\" }","simId":"12122","universalDeviceIdentifier":"1D4031AB-0DD4-4699-952A-08688CFF"}},"signInPlatform":"EOS","sessionId":"EAS-AND-raj"}},"response":{"profileReferenceId":"9vX84mj85yu79fg/sHRhKmrFhN0Px+dk9EO8o+Ia8q5IUDx6CGaUHaXRhkE9KVEn","platforms":[{"platformCode":"360"},{"platformCode":"EASE"},{"platformCode":"EOS"}],"landingURL":[{"landingPlatformCode":"AVAILABLE_PRODUCTS","landingPlatformURL":"https://verified-it.exampleone.com/sic-ui/#/pathFinder"},{"landingPlatformCode":"360BANK","landingPlatformURL":"https://secure-qa2.int.exampleone360qa.com/myaccount/banking/postlogin"},{"landingPlatformCode":"CARD","landingPlatformURL":"https://cosqa4.xyz.exampleone.com/accounts/?initial_login=true"}],"loginStatus":"CHALLENGE","ssoId":"df2dae743fda82fb804e97dcd27eb2b3","mobileOnly":false}}}

9

Thanks
I tried </> toolbar option earlier as well . Trying it again. Please let me know message is visible now ?

10
  • You're using the wrong syntax for reading and writing fields. See https://www.elastic.co/guide/en/logstash/current/event-api.html.
  • kv['key'] and kv['value'] doesn't make sense as the objects in the array don't have any such keys (the keys are named landingPlatformCode and landingPlatformURL).
  • The mutate { ... } stuff doesn't belong inside the Ruby code.
11

This issue is resolved

ruby {
code => "
require 'rubygems'
require 'json'
parray=[],
p='',
pcode='',
pflag = 'NA',
event,
obj ='',
obj = event.get('[EventStreamData][response][landingURL]')
if (obj !=nil)
obj.each do |pvar|
p = pvar['landingPlatformCode']
parray.push(p)
pcode = pcode + pvar['landingPlatformCode'] + ','
end
end
pcode = pcode.chop
parray.each do |k|
if (k=='Test' || k=='FIX' || k=='TestM' )
pflag = 'EASE'
break
end
end
puts pcode
puts pflag
event.set('pcode',pcode)
event.set('pflag',pflag)
"

12

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.