Logstash unnest nested components using ruby

I have fields that come into the system with nested components.
Using this code in logstash:

    if [receivers] {
            split {
                field => "receivers"
            }

        }

        ruby {
            code => "
                event.get('receivers').each do |key, value|
                    if value.is_a?(Hash) || value.is_a?(Array)
                        event.set('receiver_'+key, value.to_json)
                    else
                        event.set('receiver_'+key, value)
                    end
                end
            "
        }

Seems to work to unnest the document AND create a new field. But does not work if the field has nested keys. For example here is part of the field that coming in from redis:

 "receivers": [
    {
      "stream_type": "HLS",
      "target_duration": 4.1,
      "selection": {
        "found": true,
        "resolution": "1280x720",
        "bandwidth": 6281474,
        "codecs": "mp4a.40.5,avc1.640020"
      },...
  ]

field and thus does not create a new field (see image below)

Am I missing something that will allow me to create a field like:
receiver_networks_source_ip : ipaddress

I think the ruby code itself is sound because if I build an array outside of logstash I can loop through and map out keys with . in the name. So I'm guessing its a logstash thing?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.