Refer and extract unknown name attribute

[astrodi (Dominik Imrich)]

Hi there,

I would like to extract the unknown (index) name from JSON in logstash.

Structure of input is:

     ...
     "indices":  {
           "dna_master_v1": {
               ...
          }
     }

I want to extract "dna_master_v1", it is variable and I don't have exact index name (since calling the stats endopoint via alias, also user doesn't have rights to call _cat/aliases)

I have tried this in filter:

     ...
     if [indices]:  {
           mutate {
              add_field => {"index_name" => "%{[indices][0]}"}
          }
     }

and also couple of different forms like:

• "%{indices[0]}"
• "%{[indices]}"
• "%{[indices]*}"
• "[indices][0]"
• etc

With all the options I was not able to get in index desired state:
"index_name": "dna_master_v1"

all the time there is just a string for example:

"index_name": "%{[indices][0]}"

I was googling, but find nothing relevant to it (maybe it's because I'm quite a newbie in Logstash)
Thank you for your help or any clue how to move forward
Dominik

[Badger]

You are showing [indices] as a hash, not an array, so nothing like %{[indices][0]} will work. You might be able to do it with a ruby filter

ruby {
    code => '
        event.get("indices").each { |k, v|
            event.set("index_name", k)
        }
    '
}

[astrodi (Dominik Imrich)]

thank you @Badger, this works well.
I needed to put whole ruby inside "filter" element and under condition if [indices] { ... } to avoid "Ruby exception occurred: undefined method 'each' for nil:NilClass"

Thank you once again