Logstash filter to extract key/values from curl result

[Indeed2000 (Mehrdad)]

Hi
Here is the result of curl command that I need to extract key/values (columns,values)

https://gist.github.com/mehrdad2000/f106aaaad9d015845facce33c96f65f9

and here is the key/value that i need to send to elastic

{
  "series": {
    "time": "2023-04-16T07:58:40Z",
    "cpu": "cpu-total",
    "host": "server1",
    "usage_guest": 0,
    "usage_guest_nice": 0,
    "usage_idle": 99.2998249532946,
    "usage_iowait": 0,
    "usage_irq": 0.04376094023714255,
    "usage_nice": 0,
    "usage_softirq": 0.018754688670461886,
    "usage_steal": 0,
    "usage_system": 0.25006251563041776,
    "usage_user": 0.3875968991288975
  }
}

How can write filter that do this for me.
Thanks,

[Badger]

You could try

    json { source => "message" remove_field => [ "message" ]  target => "[@metadata][x]" }

    ruby {
        code => '
            begin
                series = event.remove("[@metadata][x][results][0][series][0]")
                newSeries = []
                series["values"].each { |x|
                    entry = {}
                    series["columns"].each_index { |i|
                        entry[series["columns"][i]] = x[i]
                    }
                    newSeries << entry
                }
                event.set("series", newSeries)
            rescue
            end
        '
    }
    if [series] {
        split { field => "series" }
        date { match => [ "[series][time]", "ISO8601" ] }
    }

which will produce events like

{
  "@version" => "1",
    "series" => {
                 "cpu" => "cpu23",
        "usage_iowait" => 0,
         "usage_guest" => 0,
          "usage_user" => 0,
         "usage_steal" => 0,
          "usage_nice" => 0,
                "host" => "pump4",
       "usage_softirq" => 0,
        "usage_system" => 0,
                "time" => "2023-04-16T07:58:40Z",
           "usage_irq" => 0,
          "usage_idle" => 100,
    "usage_guest_nice" => 0
},
"@timestamp" => 2023-04-16T07:58:40.000Z
}