Message to List then to Object representation

Elastic Stack Logstash
1

I groked an event resulting with the field:

"a5" => "...",
"a6" => "KILL#11##1#Cameroon#CM#CM#6#12#CM;CRISISLEX_T03_DEAD#11##1#Cameroon#CM#CM#6#12#CM;"
"a7" => "...",

Then applied the split mutation to a6 and result was

"a6" => [
    [ 0] "KILL#11##1#Cameroon#CM#CM#6#12#CM",
    [ 1] "CRISISLEX_T03_DEAD#11##1#Cameroon#CM#CM#6#12#CM",
    [ 2] "KIDNAP#8##1#Cameroon#CM#CM#6#12#CM",
]

Now I want to split by # each a6 item and create an object like this:

"a6" => [
    [ 0] "Type => KILL, Count => 11, Test => "", B => 1 C=> Cameroon, D=> CM, E=> CM, F => 6, G => 12 H => CM",
    [ 1] "object repr",
    [ 2] "object repr",
]

I had tried splitting again but it result a list with all [0], other with all [1].. etc, also with KV with default keys but it seems not to work with lists.

Any ideas?

thanks!

2

Ruby filter worked

ruby {
  code => "
    r = []
    event.get('a6').each { |values|
        data = values.split('#')
        item = {
            'type' => data[0],
            'count' => data[1],
        }
        r << item
    }
    event.set('a6_objects', r)
  "
}

Any other recomendation?

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.