Manipulating data in logstash

[KeithL (Keith)]

Beginner's question; pardon my potentially poor terminology.

I'd like to manipulate ingested data to include geo_point data to facilitate visualisation in elastic/kibana
e.g given this:

{
    "Entities" => [
        [0] {
            "Entity" => {
                "World Location" => {
                    "Height" => 1000.0,
                    "Longitude" => -0.5,
                    "Latitude" => 54.0
                },
                ...
            }
        },
        [1] {
            "Entity" => {
                ...
            }
        }
    ]
}

I'd like this:

{
    "Entities" => [
        [0] {
            "Entity" => {
                "World Location" => {
                    "Height" => 1000.0,
                    "Longitude" => -0.5,
                    "Latitude" => 54.0
                },
                "location" => {
                    "lon" => -0.5,
                    "lat" => 54.0
                },
                ...
            }
        },
        [1] {
            "Entity" => {
                ...
            }
        }
    ]
}

TIA

[KeithL (Keith)]

This helped: How can I create new field inside an array of obejcts?

    ruby {
        code => '
            entities = event.get("Entities")
            if entities.is_a? Array
                entities.each_index { |i|
                    location = {}
                    location["lat"] = entities[i]["Entity"]["World Location"]["Latitude"]
                    location["lon"] = entities[i]["Entity"]["World Location"]["Longitude"]
                    entities[i]["Entity"]["location"] = location
                }
                event.set("Entities", entities)
            end
        '
    }