Split string into array and then into key value pairs

Elastic Stack Logstash
1

Is there a way to split a string into an array and then turn each of those values into key value pairs within the array using logstash.

For example:
Turning this:
SomeField -> "key1:value1;key2:value2;key3:value3"

Into:
"SomeField": [
{
"key": "key1",
"value": "value1"
},
{
"key": "key2",
"value": "value2"
},
{
"key": "key3",
"value": "value3"
}
]

I've tried using kv filter but it doesn't quite do this.

2

I would do that using ruby.

    ruby {
        code => '
            x = event.get("SomeField")
            if x
                a = []
                x.split(";").each { |y|
                    z = y.split(":")
                    a << { "key" => z[0], "value" => z[1] }
                }
            end
            event.set("SomeField", a)
        '
    }
3

yes this worked. thank you. The previous mutate split option was not needed.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.