Logstash 6.5.1 Ruby filter how to Modify nested json array

Elastic Stack Logstash
1

Hi ,

I have like following json
{"id":"5",
"name":"John Barns",
"address":"Medison road",
"Message":
{"Header":
{"Item":
[{"Field_Name":"Status",
"Field_Value":"Ok"},
{"Field_Name":"Type",
"Field_Value":"Short"}]
}
}
}

I want to convert the array

[{"Field_Name":"status",
"Field_Value":"Ok"},
{"Field_Name":"type",
"Field_Value":"Short"}]

to

[{"status":"OK"},
{"type":"short]

Used the following script - but it does not work good

require "json"
require "rubygems"
def register(params)
@json_path_to_fix = params["json_path_to_fix"]
end

def filter(event)
arr = {}
field_names = event.get("[Message][Header][Item][Field_Name]")
field_values = event.get("[Message][Header][Item][Field_Value]")
print field_names
unless field_names.nil?
num_of_elements = field_names.count
for i in 0..num_of_elements-1 do
arr[field_names[i]]=field_values[i]
end
event.set("[Message][Header][Item]",{arr})
end
return [event]
end

Used the following doc
https://www.elastic.co/guide/en/logstash/current/event-api.html

Which does address nested arrays and how to access them .

Thanks a lot

Alon

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.