Renaming nested fields based on some condition

Elastic Stack Logstash
1

In the document, I want to change the fieldName based on conditions below

1.If the value field has JSON type. Change the value field to value-keyword and remove "value-whitespace" and **"value-standard" ** if present

2.If the value field has a size of more than 15. Change the value field to value-standard

this is the original document

"_source": {
          "applicationid" : "appid",
          "interactionId": "716bf006-7280-44ea-a52f-c79da36af1c5",
          "interactionInfo": [
            {
              "value": """{"edited":false}""",
              "value-standard": """{"edited":false}""",
              "value-whitespace" :  """{"edited":false}"""
              "title": "msgMeta"
            },
            {
              "title": "msg",
              "value": "hello testing",
            },
            {
              "title": "testing",
              "value": "I have a text that can be done and changed only the size exist more than 20 so we applied value-standard ",
            }
          ],
          "uniqueIdentifier": "a21ed89c-b634-4c7f-ca2c-8be6f31ae7b3",
        }
      }

the end result should be

"_source": {
          "applicationid" : "appid",
          "interactionId": "716bf006-7280-44ea-a52f-c79da36af1c5",
          "interactionInfo": [
            {
              "value-keyword": """{"edited":false}""",
              "title": "msgMeta"
            },
            {
              "title": "msg",
              "value": "hello testing",
            },
            {
              "title": "testing",
              "value-standard": "I have a text that can be done and changed only the size exist more than 20 and so we applied value-standard  ",
            }
          ],
          "uniqueIdentifier": "a21ed89c-b634-4c7f-ca2c-8be6f31ae7b3",
        }
      }

Here we may have from 1 nested document to 10 nested document - is there a way to interate the nested document and rename the field name based on the condition i mention above

2

You could write code to do that in a ruby filter.

3

Yeah i am also working on the ruby filter.It would be better if you give any suggestion on looping and check whether the value is JSON or not in ruby

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.