Parsing an array in Ruby

Elastic Stack Logstash
1

Hi,

I have an array field which has epoch time values. I am trying to use Ruby filter to parse it. I am getting a syntax error. I am new to Ruby so I am unable to spot the error. Can you help me out. Below is my code in Ruby

ruby {
code => {'
event.get("timestamp").each_with_index { |x, i| event["timestamp1#{i}"] =
Time.at(x) }
'}
}

1 Like
2 
ruby {
  code => '
    event.get("timestamp").each_with_index { |x, i| event.set( "timestamp1#{i}" , Time.at(x.to_i)) }
  '
}
3

HI @Badger , the event.set( "timestamp1#{i}" creates multiple fields which I do not want.

my timestamp field looks like this
"timestamp": [
1518044400000,
1518087600000,
1518109200000,
1518130800000,
1518174000000,
1518195600000,
1518217200000,
1518433200000,
1518454800000,
1518476400000,
1518519600000,
1518541200000,
1518562800000,
1518606000000,
1518627600000
]

I want to create new field timestamp 1 which looks like this

timestamp1: [
February 21st 2018, 09:49:46.420 ,
February 21st 2018, 09:49:46.420 ,
February 21st 2018, 09:49:46.420 ,
February 21st 2018, 09:49:46.420 ,
]

4 
  code => '
    timestamps = Array.new
    event.get("timestamp").each_with_index { |x, i| timestamps.push(Time.at(x.to_i / 1000)) }
    event.set( "IsThisOK" , timestamps)
  '

Does that put the right data into IsThisOK? You don't really need with_index at this point, and there are lots of other ways to do the init and push for the array, but I think it works.

2 Likes
5

Hi @Badger . it does what I wanted to try. I am not sure will I be able to use this field in Kibana as a date field

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.