Losgtash Ruby split nested fields as new field

I have below type of events.


I m looking to split nested field (group_kpi_value) and trying to store in new field.
kpi_name=E & kpi_value=511871 per chunk.

Im able to split single event in to multiple events with new filed "Kpi_name and Kpi_Value" but their(Kpi_name and Kpi_Value) values are NIL.


Below is the Ruby Code.


Please suggest where im missing.

You could try

ruby {
    code => '
        values = > event.get("group_kpi_value")
        if values.is_a? Hash
            someField = []
            values.each { |k, v|
                someField << { "kpi_name" => k, "kpi_value" => v }
            event.set("someField", someField)
split { field => "someField" }

Thanks a lot man @Badger :slightly_smiling_face:

Just one change made to bring nested fields of "someField" to root

Have added "rename" as mentioned below.


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.