Pair key with multiple values from different fields

Elastic Stack Logstash
2

Ruby filter is probably the most (or only) appropriate approach. Assuming the corresponding values are in order, and your input looks like this:

{
	"BUCKETS": "BUCKET1,BUCKET2,BUCKET3",
	"COSTS": "10,20,30",
	"BALANCES": "1000,2000,3000"
}

You can do what you need with the following snippet.
(I opted to split them inside the Ruby block since you can skip using an extra mutate block.

ruby {
    code => "
        buckets, costs, balances = event.get('BUCKETS').split(','), event.get('COSTS').split(','), event.get('BALANCES').split(',')
        buckets.each_index { |i| event.set(buckets[i], Hash['COST',costs[i],'BALANCE',balances[i]])}
    "
}

This will produce an event like this:

{
    ...,
    "BUCKET1" => {
	"BALANCE" => "1000",
	"COST" => "10"
    },
    "BUCKET2" => {
	"BALANCE" => "2000",
	"COST" => "20"
    },
    "BUCKET3" => {
	"BALANCE" => "3000",
	"COST" => "30"
    },
    ....
}
1 Like