Pull values from array of json

Elastic Stack Logstash
1

Hi,

I have the following array as a field in my event and I am looking to pull out the value from name as a list.

For example:

{colour=#f26211, exportable=true, numerical_value=null, hide_tag=false, user_id=0, name=tag1, id=9},{colour=#11d7f2, exportable=true, numerical_value=null, hide_tag=false, user_id=0, name=tag2, id=11}

Return:
['tag1','tag2']

2

Are you saying that one of the fields on your event contains that entire string? Or are you saying it is an object?

3

Yes one of the fields in the event contains that as the entire string.

4 
    mutate { gsub => [ "someField", "},{", "}|{" ] }
    mutate { split => { "someField" => "|" } }
    kv { source => "someField" target => "[@metadata][stuff]" }
    mutate { copy => { "[@metadata][stuff][name]" => "name" } }

kv will iterate over an array and extract kv pairs into arrays.

 "someField" => [
    [0] "{colour=#f26211, exportable=true, numerical_value=null, hide_tag=false, user_id=0, name=tag1, id=9}",
    [1] "{colour=#11d7f2, exportable=true, numerical_value=null, hide_tag=false, user_id=0, name=tag2, id=11}"
],
      "name" => [
    [0] "tag1,",
    [1] "tag2,"
],
5

Awesome, this works...thanks for the help

6

Parsing json with a gsub/split feels "wrong" somehow. I wonder whether this might break in some dramatic way, e.g. if your json contains whitespaces or newlines between fields.

The "cleaner" solution might be to use the JSON filter to parse the field into another field that then contains subfields (using the target parameter), and then accessing the name field within that target with the mutate-copy to pull it into your final destination. After that you can remove the json target again.

7

It's not valid JSON.

8

Oh, right. I somehow missed that.

9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.