Ruby code to push whole map to event upon aggregate end_of_task

[kevin_branch]

I understand with aggregate that push_map_as_event_on_timeout can be used to push the whole aggregated map to the event when there is a timeout, but that there is nothing like a push_map_as_event_on_end_of_task.

What would be the Ruby code I could use in my closing aggregate section (where end_of_task =>true) that would in one step push the entire map into the event? I have a variable set of map items I'll be aggregating, so enumerating them would be messy. I'm not strong with Ruby and the examples I've dug up so far are not quite getting me there.

Thanks in advance for your advice,
Kevin

[Badger]

@kevin_branch

I have a variable set of map items I'll be aggregating, so enumerating them would be messy.

I think enumeration is exactly what your need. I haven't tested it, but something like

map.each { |k,v|
    event.set(k, v)
}

[kevin_branch]

Thank you so much for weighing in on this, Badger! I believe you nailed it perfectly.

Now in my closing aggregate section in Logstash which does not use a timeout but rather "end_of_task => true", I have this code line
code => "map.each {|k,v| event.set(k,v)}"

which is successfully carrying over all the aggregated map elements into the event just like **push_map_as_event_on_timeout **would do for a timeout-terminated aggregation section.

Again, thanks for your help!

Kevin Branch