Ruby to expand nested array field into nested JSON objects

[dx123]

This is an example format of a JSON field that I have now and wish to convert:

{
	"target": [
		"Sector1 - Subsector1",
		"Sector2 - Subsector2"
	]
}

The end result desired JSON Objects Output format that I need:

{
	"target": [{
		"Sector": "Sector1",
		"Subsector": "Subsector1"
	}, {
		"Sector": "Sector2",
		"Subsector": "Subsector2"
	}]
}

I used 2 sector-sub sector pairs in the example above, however in my data it is not just restricted to a 2 pair; they could be a 1 pair or 3 pair as well. Hence I need a code template that can accommodate all scenarios.

I've done some research and found out most answers given related to this topic used the Logstash Ruby filter, but there wasn't a exact example that I could follow, I am not proficient in Ruby language so if anyone here can help with the Ruby code to perform the above dynamic conversion it will be very much appreciated!

[balumurari1]

you need to use aggregate function, to load the data

[dx123]

Can you elaborate more on this, or provide an example?

[paz]

Try this snippet to see if it suits your needs.

filter {
    ruby {
        code => "
            arr = []
            event.get('target').each { |k| arr << {:Sector => k.split(' - ')[0], :Subsector => k.split(' - ')[1]} }
            event.set('target', arr)
        "
    }
}

[dx123]

I tried your code, unfortunately it returned the same result as my original format.

[paz]

Yeah, my bad. Was a failed copy/paste on my end. Fixed it above, try it now.