Parse/split nested single JSON array in Logstash

[Thomas_Schneider]

Hello @all,

i am a completely noob and need help on a JSON-file

I am looking for a splitting/filter for the following JSON-array.
We need each value in the array as an single value in elastice.

Can someone help me ?

{
"Mot_Temp_Test" : {
"INT" : [ "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0" ]
}
}

[magnusbaeck (Magnus Bäck)]

Single value how? As separate documents? Or as separate fields in the same document? How should those fields be named?

[Thomas_Schneider]

Hi,

as a separate field int eh same document.
Name e.g. Mot_Temp_Test_[1-12].

Is this possible?

[magnusbaeck (Magnus Bäck)]

Yes, but I don't think there's a standard filter that can do exactly this. A ruby filter will let you do it though. Something like this might work:

ruby {
  code => '
    event.get("[Mot_Temp_Test][INT]").each { |i|
      event.set("Mot_Temp_Test_#{i+1}", i.to_i)
    }
  '
}

[Thomas_Schneider]

Thanks a lot