Not able to loop and read key value pairs in logstash

[Sahaya_Agnel]

Hi,

Below is the JSON content that i want to process and read all the 'amount' and sum those values based on the business logic in the Logstash config file. Can you please help ?

"ClientSalaryData": {
"person_salary_info": [
{
"client_age": "56",
"amount": "9999.00"
},
{
"client_age": "56",
"amount": "450000.00"
}
]
},

Logstash Config File:

xml {
  source => "spouse_salary_parent"
      target => "SpouseSalaryData"
  store_xml => true
  force_array => false
  xpath => [
	"/spouse_salary_info/amount/text()","personamount"
	]

}

[Badger]

The relationship between the JSON data and the XML filter is unclear. But if you want to iterate over each entry in an array and sum the amount fields then a ruby filter could do that.

[Sahaya_Agnel]

@Sahaya_Agnel

ClientSalaryData

Thank yo so much for you prompt response. Actually the above JSOn content is the output of XML filter. As i am new to ELK stack, can you please help me how to iterate and sum up the amount value in this structure ?

I am facing issues in getting the values from parent element 'ClientSalaryData'. Please help

[Badger]

Something like this. Error handling left as an exercise for the reader.

ruby {
    code  => '
        sum = 0
        event.get("[ClientSalaryData][person_salary_info]").each { |h|
            sum += h["amount"].to_f
        }
        event.set("sumOfAmount", sum)
    '
}

[Sahaya_Agnel]

Thanks a lot badger for your help in completing this.