santhoshi.p
(Santhoshi Pasumarthi)
June 15, 2022, 5:57am
1
Hi,
I have a response like below I'm unable to figure how i need to proceed further. Kindly provide any solution.
Response:
{
"columns": [
[0] {
"label": "ICMP",
"ingress": true
},
[1] {
"label": "ICMP",
"ingress": false
},
[2] {
"label": "snmp",
"ingress": true
},......
],
"timestamps": [
[0] 1655089145032,
[1] 1655089445032,
[2] 1655089745032,
.................],
"values": [
186710.61691104108,
185786.64188565157,
186711.51350526334,
........],
}
I need output like
{
"label": "ICMP",----> column[0][0]
"ingress": true,----> column[0][1]
"Value": 186710.61691104108, ---> value[0]
"timestamp" : 1655089145032 ---> timestamp [0]
}
{
// Like wise in all the records
}.....
Thank you
Badger
June 15, 2022, 4:48pm
2
You could try
ruby {
code => '
columns = event.get("columns")
timestamps = event.get("timestamps")
values = event.get("values")
if columns.is_a? Array and timestamps.is_a? Array and values.is_a? Array and
columns.length == timestamps.length and columns.length == values.length and
columns[0].is_a? Hash
a = []
columns.each_index { |x|
a << { "label" => columns[x]["label"],
"ingress" => columns[x]["ingress"],
"Value" => values[x],
"timestamp" => timestamps[x]
}
}
event.set("[@metadata][data]", a)
end
'
remove_field => [ "columns", "timestamps", "values" ]
}
if [@metadata][data] {
split { field => "[@metadata][data]" }
ruby {
code => '
event.get("[@metadata][data]").each { |k, v|
event.set(k, v)
}
'
}
}
system
(system)
Closed
July 13, 2022, 4:49pm
3
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.