Match data from two arrays

Elastic Stack Logstash
1

Hi
Can You help me for make a method for merge data between two arrays and match this into one document.

pattern- > name of fields
[a-b-c-d-e]

//we have a 3 events separated by the |
value_field = 5-7-10-12-9|5-7-9-14-15|5-7-9-14-15

eligible output:

a1 = 5
b1 = 7
c1 = 10
d1 = 12
e1 = 9
a2 = 5
b2 = 7
c2 = 9
d2 = 14
e2 = 15
a3 = 6
b3 = 2
c3 = 2
d3 = 4
e3 = 6

I need this data in the same document. So this blocks are separated by '|' pipe shouldn't be splitted between document.
It could be a trivial case but I'm a fresh with ruby
Thanks in advance.

2

The following works, but is extremely ugly.

    ruby {
        code => '
            f = event.get("value_field")
            if f
                fs = f.split("|")
                fs.each_index{ |x|
                    fss = fs[x].split("-")
                    fss.each_index { |y|
                        event.set("#{(97 + y).chr}#{x+1}", fss[y])
                    }
                }
            end
        '
    }

In ASCII a/b/c/d/e are character codes 97/98/99/100/100. Ruby array indices start at zero, so for the first character of the field name we want to convert 97 plus the array index to a character, then we want to convert 1 plus the other index to a string....

3

Thanks @Badger I've found the way

  ruby {
        code => '
        name = ["a", "b", "c", "d"]
            f = event.get("bearers")
            if f
                fs = f.split("|")
                fs.each_index{ |x|
                    fss = fs[x].split("-")
                    fss.each_index { |y|
					name.each_with_index do |item, index|
                        event.set("#{item}_#{x+1}", fss[y])
					end
                    }
                }
            end
        '
    }
4

@Badger One more thing, if I will provide in input mixed value for ex. string instead of number,
this arrays should be hash of array?
input:
value_field = 5-7-10-none-9|5-7-9-disable-15|5-enable-9-14-15

5

That should not matter as long as the fields are delimited by -

6

So I've done some small exercise:
decomposes this field but in reverse order, something is not right here, and it does not spit out the string in the value

input :
value_field = 5-7-10-none-9|5-7-9-disable-15|5-enable-9-14-15

code:

ruby {
        code => '
        name = ["a", "b", "c", "d", "e"]
        
            f = event.get("value_field ")
 
            if f
                fs = f.split("|")
                fs.each_index{ |x|
                    fss = fs[x].split("-")
                    fss.each_index { |y|
                      name.each_with_index do |item, index|
                        event.set("x_#{item}_#{x+1}", fss[y])
					            end
                    }
                }
            end
        '
    }

output :

"x_a_1"	=>	"9",
"x_a_2"	=>	"15"
"x_a_3"	=>	"15",
"x_b_1"	=>	"9",
"x_b_2"	=>	"15",
"x_b_3"	=>	"15",
"x_c_1"	=>	"9",
"x_c_2"	=>	"15",
"x_c_3"	=>	"15",
"x_d_1"	=>	"9",
"x_d_2"	=>	"15",
"x_d_3"	=>	"15",
"x_e_1"	=>	"9",
"x_e_2"	=>	"15",
"x_e_3"	=>	"15",
7

@Badger How to correctly use name.each_with_index for expected output

8

@Badger Can You look once again on this case?

also I've tried to do something like this but it's not correct


event.set("#{name.each { |item| puts item}}_#{x+1}", fss[y])
9

I have no idea what you are asking. You specified a problem, I provided a solution. What issue do you have with the solution?

10

Yes Badger I’m very appreciate for take solution but i intended for use array not conversion from char :wink: as workaround

11

Probably

name = ["a", "b", "c", "d", "e"]
...
                fss.each_index { |y|
                    event.set("#{name[y]}#{x+1}", fss[y])
                }
12

Thx! well done

13

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.