Replacing part of one field's string with value from another field

Elastic Stack Logstash
1

Hi,
I'm parsing an XML and I currently have the following array:

 errorinfo.Msg	 {
  "Index": [
    "1"
  ],
  "Display": [
    "0"
  ],
  "Name": [
    "Movement too slow"
  ],
  "Text": [
    "1 Movement too slow concerning head time model nominal(%1) nominal_esw(%2) actual(%3) travel-profile(%4) acceleration(%5)"
  ],
  "DevOnly": [
    "1"
  ],
  "Params": [
    {
      "Param": [
        {
          "Type": [
            "15"
          ],
          "Value": [
            "0.114285"
          ]
        },
        {
          "Type": [
            "15"
          ],
          "Value": [
            "0"
          ]
        },
        {
          "Type": [
            "15"
          ],
          "Value": [
            "0.1843"
          ]
        },
        {
          "Type": [
            "0"
          ],
          "Value": [
            "100"
          ]
        },
        {
          "Type": [
            "12"
          ],
          "Value": [
            "7.29412"
          ]
        }
      ]
    }
  ]
}

The text field contains an error message and few placeholders for values, that are stored in Params section (%1, %2, etc). The number of parameters is dynamic. There can be 0, 1, 5 or even more of them. Also, parameters type are not indicate the place they are suppose to be placed. The only thing that indicates it is the order of parameters. Which means that first parameter should be pasted into %1, second in %2, etc.
Is it possible to copy parameters value and paste them into a new field called error_text along with the entire message, like this?
1 Movement too slow concerning time model nominal(0.114285) nominal_esw(0) actual(0.1843) travel-profile(100) acceleration(7.29412)

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.