Parsing a list of lists with logstash filter

Elastic Stack Logstash
1

Hello friends.

I have a list of lists in the form below:

doc 1:

[[40004, 10], [40005, 12]]

doc 2:

[[40004, 8], [40006, 12], [20002, 3]]

I want to change them to the following form:

doc 1:

{
    "40004": 10,
    "40005": 12
}

doc 2:

{
    "40004": 8,
    "40006": 12,
    "20002": 3
}

How can I do this with logstash filter ?

Thanks

2

You will need to use a ruby filter, something similar to this.

3

I solved the problem in the following way:

mutate {

        gsub => [
            ## handeling multiple items
            "items", "\]\,", "-",    ### [[40004, 10- [40005, 12]]
            
            ## removing extra characteres
            "items", "[\[\]]", "",    ### 40004, 10- 40005, 12
            "items", "\s", ""     ### 40004,10-40005,12
        ]
    }

kv {
    source => "items"
    field_split => "-"
    value_split => ","
    prefix => "item_"
}

Thanks @Badger

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.