Ruby to expand nested array field into nested JSON objects


#1

This is an example format of a JSON field that I have now and wish to convert:

{
	"target": [
		"Sector1 - Subsector1",
		"Sector2 - Subsector2"
	]
}

The end result desired JSON Objects Output format that I need:

{
	"target": [{
		"Sector": "Sector1",
		"Subsector": "Subsector1"
	}, {
		"Sector": "Sector2",
		"Subsector": "Subsector2"
	}]
}

I used 2 sector-sub sector pairs in the example above, however in my data it is not just restricted to a 2 pair; they could be a 1 pair or 3 pair as well. Hence I need a code template that can accommodate all scenarios.

I've done some research and found out most answers given related to this topic used the Logstash Ruby filter, but there wasn't a exact example that I could follow, I am not proficient in Ruby language so if anyone here can help with the Ruby code to perform the above dynamic conversion it will be very much appreciated!


#2

you need to use aggregate function, to load the data


#3

Can you elaborate more on this, or provide an example?


(Paris Mermigkas) #4

Try this snippet to see if it suits your needs.

filter {
    ruby {
        code => "
            arr = []
            event.get('target').each { |k| arr << {:Sector => k.split(' - ')[0], :Subsector => k.split(' - ')[1]} }
            event.set('target', arr)
        "
    }
}

#5

I tried your code, unfortunately it returned the same result as my original format.


(Paris Mermigkas) #6

Yeah, my bad. Was a failed copy/paste on my end. Fixed it above, try it now.


(system) #7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.