Logstash: filter to convert string to array of values


I have an input log string which contains some easy to regex-matching keywords. I want to index them as an array of values. E.g.

"message"="User's locations: locERTY locRUIE locFGHD locTYUS"

The below code successfully does what I want, in the tag field:

ruby {
    code => 'event.get("message").scan(/loc[A-Z]{4}/).each {|loc| event.tag(loc)}'

So, this outputs:

"tags": [

Now, since I have several such lists, I want to use custom field names, instead of tag. The closest I got was this, which is not perfect because the result output is a key-value pair:

ruby {
    code => 'i=0; event.get("message").scan(/loc[A-Z]{4}/).each {|loc| event.set("[locs][#{i}]",loc); i+=1}'

This outputs:

"locs": [

How can I output a custom loc field similar to the tag one above (with ruby or not)?

Thank you!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.