Split Nested Object

Elastic Stack Logstash
1

I have a json log that looks like this:
{
"a" : "info",
"data" : {
"x1" : { Object },
"x2" : { Object },
"x3" : { Object }
}
}

I would like to convert it to look like this:
{
"a" : "info",
"data" : {
"x1" : { Object },
}
}

{
"a" : "info",
"data" : {
"x2" : { Object },
}
}

{
"a" : "info",
"data" : {
"x3" : { Object }
}
}

If it was an array I could do it with split, but it isn't. Can I convert it to an array and then split it ? Or there is another way to do it ?

Best Regards,
Filipe Ferreira.

2

You could use a ruby filter to transform

"data" : {
  "x1" : { Object },
  "x2" : { Object },
  "x3" : { Object }
}

into something like

"data" : [
  ["x1", { Object } ],
  ["x2", { Object } ],
  ["x3", { Object } ]
]

which would then be splittable (and then you'd need another ruby filter to get un-array the values).

3

Hi Magnus Back,

I was able to transform it with ruby filter and with help with event.get and event.set. With event.get, I got only the data block only and with a cycle, I got x1, x2, x3 and pushed them into an array. Finally, with event.set, I put the resulting array on the msg.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.