Logstash Create and Access Array

Elastic Stack Logstash
#1

hi logstash,

Is it possible to spilt the log as below based on ',' to array ?

"message" => "....",
"host" => "10.10.11.12",
"@version" => "1",
"@timestamp" => "2016-04-13T01:52:43.535Z",
"DISMAN-EVENT-MIB::sysUpTimeInstance" => "22 days, 16:33:23.24",
"sixth_filed::bgpPeerLastError_A_1_1_1_1" => "sixth_filed_content",
"seven_filed::bgpPeerLastError_A_1_1_1_1" => "seven_filed_content",
"source_ip" => "10.10.11.12"

array looks like ,
[message] = "...",
[host] = "10.10.11.12",
[version] = "1",
[timestamp]="2016-04-13T01:52:43.535Z"
....... ..

Any and all help is much appreciated!

#2

Sorry, I don't understand. What's the string you want to split? You're showing two map-like representations of log messages but no comma-separated string and no array.

#3

I want to spilt the log based on ", as follows,

"message" => #<SNMP::SNMPv1_Trap:0x8054b7d @enterprise=[1.3.6.1.4.1.9.9.187], @timestamp=#<SNMP::TimeTicks:0x60589092 @value=906196836>, @varbind_list=[#<SNMP::VarBind:0x796f52ad @name=[1.3.6.1.2.1.15.3.1.14.211.79.48.54], @value="\x00\x00">, #<SNMP::VarBind:0x5b13b05e @name=[1.3.6.1.2.1.15.3.1.2.211.79.48.54], @value=#<SNMP::Integer:0x7f6b77ae @value=1>>, #<SNMP::VarBind:0x731481c5 @name=[1.3.6.1.4.1.9.9.187.1.2.1.1.7.10.10.11.12], @value="">, #<SNMP::VarBind:0x706d5f30 @name=[1.3.6.1.4.1.9.9.187.1.2.1.1.8.10.10.11.12], @value=#<SNMP::Integer:0x36ba8023 @value=3>>], @specific_trap=1, @source_ip="10.10.11.12", @agent_addr=#<SNMP::IpAddress:0x1248575d @value="\xC0\xA8\a\f">, @generic_trap=6>",
"host" => "10.10.11.12",
"@version" => "1",
"@timestamp" => "2016-04-13T01:52:43.535Z",
"DISMAN-EVENT-MIB::sysUpTimeInstance" => "22 days, 16:33:23.24",
"sixth_filed::bgpPeerLastError_A_1_1_1_1" => "sixth_filed_content",
"seven_filed::bgpPeerLastError_A_1_1_1_1" => "seven_filed_content",
"source_ip" => "10.10.11.12"

#4

Have you looked at the kv filter? Or, if you really want an array rather than a set of fields, the mutate filter's split option?

#5