# Logstash filter to extract key/values from curl result

**URL:** <https://discuss.elastic.co/t/logstash-filter-to-extract-key-values-from-curl-result/330083>\
**Category:** Logstash\
**Created:** [April 16, 2023, 8:59am UTC](https://discuss.elastic.co/t/logstash-filter-to-extract-key-values-from-curl-result/330083 "2023-04-16T08:59:54Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Indeed2000](https://avatars.discourse-cdn.com/v4/letter/i/dc4da7/32.png) [@Indeed2000](https://discuss.elastic.co/u/Indeed2000)\
**Post date:** [April 16, 2023, 8:59am UTC](https://discuss.elastic.co/t/logstash-filter-to-extract-key-values-from-curl-result/330083/1 "2023-04-16T08:59:54Z")

</div>

Hi  
Here is the result of curl command that I need to extract key/values (columns,values)

> <https://gist.github.com/mehrdad2000/f106aaaad9d015845facce33c96f65f9>

and here is the key/value that i need to send to elastic

```auto

{
  "series": {
    "time": "2023-04-16T07:58:40Z",
    "cpu": "cpu-total",
    "host": "server1",
    "usage_guest": 0,
    "usage_guest_nice": 0,
    "usage_idle": 99.2998249532946,
    "usage_iowait": 0,
    "usage_irq": 0.04376094023714255,
    "usage_nice": 0,
    "usage_softirq": 0.018754688670461886,
    "usage_steal": 0,
    "usage_system": 0.25006251563041776,
    "usage_user": 0.3875968991288975
  }
}

```

How can write filter that do this for me.  
Thanks,

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [April 18, 2023, 1:00am UTC](https://discuss.elastic.co/t/logstash-filter-to-extract-key-values-from-curl-result/330083/2 "2023-04-18T01:00:52Z")

</div>

You could try

```
    json { source => "message" remove_field => ["message"] target => "[@metadata][x]" }

    ruby {
        code => '
            begin
                series = event.remove("[@metadata][x][results][0][series][0]")
                newSeries = []
                series["values"].each { |x|
                    entry = {}
                    series["columns"].each_index { |i|
                        entry[series["columns"][i]] = x[i]
                    }
                    newSeries << entry
                }
                event.set("series", newSeries)
            rescue
            end
        '
    }
    if [series] {
        split { field => "series" }
        date { match => ["[series][time]", "ISO8601" ] }
    }

```

which will produce events like

```
{
  "@version" => "1",
    "series" => {
                 "cpu" => "cpu23",
        "usage_iowait" => 0,
         "usage_guest" => 0,
          "usage_user" => 0,
         "usage_steal" => 0,
          "usage_nice" => 0,
                "host" => "pump4",
       "usage_softirq" => 0,
        "usage_system" => 0,
                "time" => "2023-04-16T07:58:40Z",
           "usage_irq" => 0,
          "usage_idle" => 100,
    "usage_guest_nice" => 0
},
"@timestamp" => 2023-04-16T07:58:40.000Z
}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 16, 2023, 1:01am UTC](https://discuss.elastic.co/t/logstash-filter-to-extract-key-values-from-curl-result/330083/3 "2023-05-16T01:01:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.