Rename nested field in Logstash using Ruby filter

Elastic Stack Logstash
1

Hi,

I have some issues with rename a nested field in json.

Example of nested field:
test_results.result.legacy.entities.user_mentions.name then i want to rename it to displayname

I have try this method, but unfortunately, it only rename the field to test_results.result.legacy.entities.user_mentions.namedisplay instead of namedisplay only

Example of method:

ruby {
  code => "
    user_mentions = event.get('[test_results][result][legacy][entities][user_mentions]')
    if user_mentions
      b = []
      user_mentions.each { |k|
        k['namedisplay'] = k['name']
        k.delete('name')
        logger.info('for each k', 'value' => k)
        b << k
      }
      event.set('[test_results][result][legacy][entities][user_mentions]', b)
    end
  "
}

Really appreciated with all your help. Thanks

2

The first line iterates over each member (k) of user_mentions, which is the value of [test_results][result][legacy][entities][user_mentions]. So you are setting [test_results][result][legacy][entities][user_mentions][namedisplay] to the value of [test_results][result][legacy][entities][user_mentions][name].

Perhaps you should change the second line to

event.set("namedisplay", k["name"])

but if [user_mentions] is an array then it seems unlikely that that would be right.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.