Ruby filter to map different array elements into one record

Hi,

I have a response like below I'm unable to figure how i need to proceed further. Kindly provide any solution.

Response:
{
"columns": [
[0] {
"label": "ICMP",
"ingress": true
},
[1] {
"label": "ICMP",
"ingress": false
},
[2] {
"label": "snmp",
"ingress": true
},......
],
"timestamps": [
[0] 1655089145032,
[1] 1655089445032,
[2] 1655089745032,
.................],
"values": [
186710.61691104108,
185786.64188565157,
186711.51350526334,
........],
}

I need output like
{
"label": "ICMP",----> column[0][0]
"ingress": true,----> column[0][1]
"Value": 186710.61691104108, ---> value[0]
"timestamp" : 1655089145032 ---> timestamp [0]
}
{
// Like wise in all the records
}.....

Thank you

You could try

    ruby {
        code => '
            columns = event.get("columns")
            timestamps = event.get("timestamps")
            values = event.get("values")
            if columns.is_a? Array and timestamps.is_a? Array and values.is_a? Array and
                    columns.length == timestamps.length and columns.length == values.length and
                    columns[0].is_a? Hash
                a = []
                columns.each_index { |x|
                    a << { "label" => columns[x]["label"],
                        "ingress" => columns[x]["ingress"],
                        "Value" => values[x],
                        "timestamp" => timestamps[x]
                    }
                }
                event.set("[@metadata][data]", a)
            end
        '
        remove_field => [ "columns", "timestamps", "values" ]
    }
    if [@metadata][data] {
        split { field => "[@metadata][data]" }
        ruby {
            code => '
                event.get("[@metadata][data]").each { |k, v|
                    event.set(k, v)
                }
            '
        }
    }

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.