Replace string within a pattern in ruby

Elastic Stack Logstash
1

Trying to find out a way on how to replace a substring within nested curly brackets
my input string in a single line:
{"service": "service-2bc902c2", "report_timestamp": "2017-12-18T12:58:32.545191", "service_engine": "xyz-se-gdckc", "log_id": 22681, "client_ip": "1.8.7.111", "client_src_port": 556, "client_dest_port": 4403, "client_rtt": 143, "ssl_session_id": "183728e1fb7778095c", "ssl_version": "TLSv1.2", "ssl_cipher": "RSA-AES256-GCM-SHA384", "http_version": "1.1", "method": "GET", "uri_path": "/test/service/atom/forms/catalog/owned", "uri_query": "results=10&start=0&sortKey={its:" me*}update_date&sortOrder=desc&facet={id:tag,count": 30}&o.p60", "referer": "https://test.abc.com/communities/service/html/ownedcommunities", "user_agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36", "persistence_used": 1, "host": "w.test.com", "persistent_session_id": 965981681, "pool": "vs_ip": "1.16.14.26", "body_updated": "NOT_UPDATED", "vs_name": "test_g4_4403"}

trying to replace string within nested {} such as {id:tag,count": 30} with colons, quotes removed within original input

I am using ruby to replace. so far tried this, but its not working

ruby block

ruby {
code => "
str = event.get('message')
copy=str
nested = str.scan(/(?={((?:[^{}]++|{\g<1>})++)})/)
nested[1,nested.length-1].each {
|longVariableName|
replaced=longVariableName.to_s.gsub(/:/,'').gsub(/\s+/,'').gsub(/"/,'').gsub(/\/,'')
longVariableName=longVariableName.to_s.gsub(/\"/,'abc').gsub(/"/,'').gsub(/abc/,'"').gsub(/\/,'')
printf '\r\nreplacing %s with %s ' , longVariableName , replaced
copy.gsub( /#{longVariableName}/ ,replaced)

}

printf ' The final string is %s' , copy
event.set('message',str)
"
}
Please help

2

Don't operate on the whole JSON string. Deserialize the JSON string into structured fields, then apply transformations.

I don't understand what you're trying to do. What, exactly, does the input look like right now? What would you like it to look like instead?

3

Hi Magnus,
I have to operate on entire log line (which is not json structured yet) to make it structured json. I have some characters in the nested json like structure which is not right as per json structure, such as some double quotes, commas in the string which is not kv separator.
Thanks

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.