Split array without generating new event

Elastic Stack Logstash
1

Hi,
I'm trying to parse some JSON from scopus database. I'm almost done using mutate and split plugins, but I'm unable to get a final step. Using json plugin and rubydebug output, I get: :

{
"search-results": {
  "author" => [
    [0] {
              "@_fa" => "true",
              "@seq" => "1",
        "author-url" => "http://api.elsevier.com/content/author/author_id/7201973766",
            "authid" => "7201973766",
          "authname" => "Hughes B.",
           "surname" => "Hughes",
        "given-name" => "Brent M.",
          "initials" => "B.M.",
              "afid" => [
            [0] {
                "@_fa" => "true",
                   "$" => "60025262"
            }
        ]
    },
    [1] {
              "@_fa" => "true",
              "@seq" => "2",
        "author-url" => "http://api.elsevier.com/content/author/author_id/26660462900",
            "authid" => "26660462900",
          "authname" => "Chan J.",
           "surname" => "Chan",
        "given-name" => "John S.",
          "initials" => "J.S.",
              "afid" => [
            [0] {
                "@_fa" => "true",
                   "$" => "60025262"
            }
        ]
    },
    [2] {
              "@_fa" => "true",
              "@seq" => "3",
        "author-url" => "http://api.elsevier.com/content/author/author_id/7005693830",
            "authid" => "7005693830",
          "authname" => "Koval D.",
           "surname" => "Koval",
        "given-name" => "Don O.",
          "initials" => "D.O.",
              "afid" => [
            [0] {
                "@_fa" => "true",
                   "$" => "60025262"
            }
        ]
    }
 ]
}

And I would like to get something like:

{
"search-results": {
  "author0" => {
              "@_fa" => "true",
              "@seq" => "1",
        "author-url" => "http://api.elsevier.com/content/author/author_id/7201973766",
            "authid" => "7201973766",
          "authname" => "Hughes B.",
           "surname" => "Hughes",
        "given-name" => "Brent M.",
          "initials" => "B.M.",
              "afid" => [
            [0] {
                "@_fa" => "true",
                   "$" => "60025262"
            }
        ]
    },
    "author1" => {
              "@_fa" => "true",
              "@seq" => "2",
        "author-url" => "http://api.elsevier.com/content/author/author_id/26660462900",
            "authid" => "26660462900",
          "authname" => "Chan J.",
           "surname" => "Chan",
        "given-name" => "John S.",
          "initials" => "J.S.",
              "afid" => [
            [0] {
                "@_fa" => "true",
                   "$" => "60025262"
            }
        ]
    },
    "author2" => {
              "@_fa" => "true",
              "@seq" => "3",
        "author-url" => "http://api.elsevier.com/content/author/author_id/7005693830",
            "authid" => "7005693830",
          "authname" => "Koval D.",
           "surname" => "Koval",
        "given-name" => "Don O.",
          "initials" => "D.O.",
              "afid" => [
            [0] {
                "@_fa" => "true",
                   "$" => "60025262"
            }
        ]
    }
}

I'd been playing with some ruby code, but without success.
Briefly, I'd like to convert each array entry in an object, without splitting them in different events.

thank you.

UPDATE: I tried https://discuss.elastic.co/t/parse-split-nested-single-json-array-in-logstash/72059 without success

 ruby {
   code => '
           event.get("[search-results][title]").each { |i|
           event.set("search-results_Title_#{i+1}", i.to_i)
           }
   '
 }
2

I reply myself:

	ruby {
  code => '
    event["[search-results][title]"].each_index { |i|
    	event["[search-results][title#{i}]"] = event["[search-results][title][#{i}]"]
    }
  '
}

So, now is solved. Maybe this post could be useful to others.

1 Like
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.