Parse/split nested single JSON array in Logstash


(Thomas Schneider) #1

Hello @all,

i am a completely noob and need help on a JSON-file :slight_smile:

I am looking for a splitting/filter for the following JSON-array.
We need each value in the array as an single value in elastice.

Can someone help me ?

{
"Mot_Temp_Test" : {
"INT" : [ "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0", "0" ]
}
}


Split array without generating new event
(Magnus Bäck) #2

Single value how? As separate documents? Or as separate fields in the same document? How should those fields be named?


(Thomas Schneider) #3

Hi,

as a separate field int eh same document.
Name e.g. Mot_Temp_Test_[1-12].

Is this possible?


(Magnus Bäck) #4

Yes, but I don't think there's a standard filter that can do exactly this. A ruby filter will let you do it though. Something like this might work:

ruby {
  code => '
    event.get("[Mot_Temp_Test][INT]").each { |i|
      event.set("Mot_Temp_Test_#{i+1}", i.to_i)
    }
  '
}

(Thomas Schneider) #5

Thanks a lot :slight_smile:


(system) #6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.