Hello @magnusbaeck,
Thank you for your effort and help resolving Logstash questions. I have learned a lot from you.
Amongst other sources, I am receiving logs from RabbitMQ in valid JSON but with JSON objects in array.
I figured there are various ways to solve this if you know which particular objects you want to parse.
In my case there are plenty of different objects with different "first" object (in this case "first"). For example: tickerUpdateMessages, orderBook, etc... (I am attaching screenshot for easier reference).
Because there is plenty of different objects, I cannot set these fields manually for each one with use of json { source= ??, target=??}
even though it is valid JSON.
Could you point me to the right use of codec or should I use ruby code like this one below.
ruby {
init => "
def arrays_to_hash(h)
h.each do |k,v|
# If v is nil, an array is being iterated and the value is k.
# If v is not nil, a hash is being iterated and the value is v.
value = v || k
if value.is_a?(Array)
# "value" is replaced with "value_hash" later.
value_hash = {}
value.each_with_index do |v, i|
value_hash[i.to_s] = v
end
h[k] = value_hash
end
if value.is_a?(Hash) || value.is_a?(Array)
arrays_to_hash(value)
end
end
end
"
code => "arrays_to_hash(event.to_hash)"
}
Best,N.