Rename recursively field names in nested structure without changing the structure

Elastic Stack Logstash
1

Hello, I have an event which is nested like this:

{
"test1": null,
"test2": null,
"test3": {
        "test31": null,
        "test32": null,
         },
"test4":{ 
              "test5": [
                {     
                         "test6": null,
                         "test7": null
                 } ]
}

etc

and I would like to find null values in it recursively and rename the fields that have those null values. So far I have done something like this in logstash config, it only handles hashes (haven't found how to handle arrays this way)

def first_meth(e)
	hash_event = e.to_hash
	new_meth(hash_event, e)
end

def new_meth(hash, ev)
	hash.each do |key,value|
		if value == nil
			ev.set("[#{key}_null]", value)
			ev.remove("[#{key}]")
		end
		if value.kind_of?(Hash)
			f = ev.get("[#{key}]")
			new_meth(f, ev)
		end
	end
end

somewhere else in the ruby code I call

first_meth(event)

the thing is it puts everything in root level. I don't want to change the structure. How could I do this?

{
"test1_null": null,
"test2_null": null,
"test3": {
        "test31_null": null,
        "test32_null": null,
         },
"test4":{ 
              "test5": [
                {     
                         "test6_null": null,
                         "test7_null": null
                 } ]
}

Thank you

2

Not in the mood to write code on Thanksgiving, but take a look at this function. It recursively works its way through an event, including hashes and arrays, and keeps track of what the thing it is working on is called, which would allow you do something like

event.set("#{name}_null", event.remove(name))
3

Hello, thanks for the reply. I changed my code and did

def first_meth(e)
	hash_event = e.to_hash
        hash event.each { |k,v|
	           new_meth(v, k, e)
        }
end

def new_meth(object, name, ev)
		if value == nil
			ev.set("#{name}_null", value)
			ev.remove(name)
		end
		if value.kind_of?(Hash)
			f = ev.get("#{name}")
                        f.each { |k,v|
                                 nm = "#{name}[#{k}]"
			         new_meth(v, nm, ev)
                        }
		end
end

but it gives error because of nm. how can I fix it? Is it ok to do nm = "#{name}][#{k}" and
ev.set("[#{name}_null]", value)? but will that work if i have more deep nested hashes? thank you

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.