Parse/split nested single JSON array in Logstash

Hello @all,

i am a completely noob and need help on a JSON-file :slight_smile:

I am looking for a splitting/filter for the following JSON-array.
We need each value in the array as an single value in elastice.

Can someone help me ?

"Mot_Temp_Test" : {
"INT" : [ "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0" ]

Single value how? As separate documents? Or as separate fields in the same document? How should those fields be named?


as a separate field int eh same document.
Name e.g. Mot_Temp_Test_[1-12].

Is this possible?

Yes, but I don't think there's a standard filter that can do exactly this. A ruby filter will let you do it though. Something like this might work:

ruby {
  code => '
    event.get("[Mot_Temp_Test][INT]").each { |i|
      event.set("Mot_Temp_Test_#{i+1}", i.to_i)
1 Like

Thanks a lot :slight_smile:

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.