Parse array of array in Logstash

I have some logs like below which is an array within which there are two more arrays, I need to split them into individual events.

[{"nodes":[{"id":"node1","label":["Label1", "Label2"],"properties":"property1"},{"id":"node2","label":["Label1", "Label2"],"properties":"property2"}],"relationships":[{"id":"relation1","properties":"property1"},{"id":"relation2","properties":"property2"}]}]

Expected result:

{
	"id" => "node1"
	"label_0" => "Label1"
	"label_1" => "Label2"
	"properties" => "property1"
}
{
	"id" => "node2"
	"label_0" => "Label1"
	"label_1" => "Label2"
	"properties" => "property2"
}
{
	"id" => "relation1"
	"properties" => "property1"
}
{
	"id" => "relation2"
	"properties" => "property2"
}

You can split that event into multiple events using a split filter. You can expand an array into multiple fields using something like this.

Thank you Badger. Your solution worked. Here is my final code.

        ruby {
        code => '
                all_events = Array.new
                ########### Parse both arrays into one ############
                event.get("nodes").each_with_index { |val, idx|
                all_events.push(val) }
                event.get("relationships").each_with_index { |val, idx|
                all_events.push(val) }

                event.set("all_events", all_events)


                event.remove("nodes")
                event.remove("relationships")
        '}
        split { field => "[all_events]" }

        ruby {
        code => '
                event.get("all_events").each { |k, v|
                event.set(k, v) }
                event.remove("all_events")
                event.get("properties").each { |k, v|
                event.set("prop_" + k, v) }
                event.remove("properties")

                #### this is an extra array I got inside each JSON object #####
                if event.get("labels")
                        event.get("labels").each_with_index { |val, idx|
                        event.set("label_" + idx.to_s, val) }
                        event.remove("labels")
                end

        '}

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.