Hi,
I'm trying to parse some JSON from scopus database. I'm almost done using mutate and split plugins, but I'm unable to get a final step. Using json
plugin and rubydebug
output, I get: :
{
"search-results": {
"author" => [
[0] {
"@_fa" => "true",
"@seq" => "1",
"author-url" => "http://api.elsevier.com/content/author/author_id/7201973766",
"authid" => "7201973766",
"authname" => "Hughes B.",
"surname" => "Hughes",
"given-name" => "Brent M.",
"initials" => "B.M.",
"afid" => [
[0] {
"@_fa" => "true",
"$" => "60025262"
}
]
},
[1] {
"@_fa" => "true",
"@seq" => "2",
"author-url" => "http://api.elsevier.com/content/author/author_id/26660462900",
"authid" => "26660462900",
"authname" => "Chan J.",
"surname" => "Chan",
"given-name" => "John S.",
"initials" => "J.S.",
"afid" => [
[0] {
"@_fa" => "true",
"$" => "60025262"
}
]
},
[2] {
"@_fa" => "true",
"@seq" => "3",
"author-url" => "http://api.elsevier.com/content/author/author_id/7005693830",
"authid" => "7005693830",
"authname" => "Koval D.",
"surname" => "Koval",
"given-name" => "Don O.",
"initials" => "D.O.",
"afid" => [
[0] {
"@_fa" => "true",
"$" => "60025262"
}
]
}
]
}
And I would like to get something like:
{
"search-results": {
"author0" => {
"@_fa" => "true",
"@seq" => "1",
"author-url" => "http://api.elsevier.com/content/author/author_id/7201973766",
"authid" => "7201973766",
"authname" => "Hughes B.",
"surname" => "Hughes",
"given-name" => "Brent M.",
"initials" => "B.M.",
"afid" => [
[0] {
"@_fa" => "true",
"$" => "60025262"
}
]
},
"author1" => {
"@_fa" => "true",
"@seq" => "2",
"author-url" => "http://api.elsevier.com/content/author/author_id/26660462900",
"authid" => "26660462900",
"authname" => "Chan J.",
"surname" => "Chan",
"given-name" => "John S.",
"initials" => "J.S.",
"afid" => [
[0] {
"@_fa" => "true",
"$" => "60025262"
}
]
},
"author2" => {
"@_fa" => "true",
"@seq" => "3",
"author-url" => "http://api.elsevier.com/content/author/author_id/7005693830",
"authid" => "7005693830",
"authname" => "Koval D.",
"surname" => "Koval",
"given-name" => "Don O.",
"initials" => "D.O.",
"afid" => [
[0] {
"@_fa" => "true",
"$" => "60025262"
}
]
}
}
I'd been playing with some ruby
code, but without success.
Briefly, I'd like to convert each array entry in an object, without splitting them in different events.
thank you.
UPDATE: I tried https://discuss.elastic.co/t/parse-split-nested-single-json-array-in-logstash/72059 without success
ruby {
code => '
event.get("[search-results][title]").each { |i|
event.set("search-results_Title_#{i+1}", i.to_i)
}
'
}