Splitting a json array format with same fields name

[Adabi_Raihan]

Hi Everyone,

Currently, i have this kind of JSON array with the same field, what I wanted is to split this data into an independent field and the field name is based on a "name" field

events.parameters (this is the field name of JSON array)

{
"name": "USER_EMAIL",
"value": "dummy@yahoo.com"
},
{
"name": "DEVICE_ID",
"value": "Wdk39Iw-akOsiwkaALw"
},
{
"name": "SERIAL_NUMBER",
"value": "9KJUIHG"
}

expected output:

events.parameters.USER_EMAIL : dummy@yahoo.com
events.parameters.DEVICE_ID: Wdk39Iw-akOsiwkaALw
events.parameters.SERIAL_NUMBER : 9KJUIHG

Thanks.

[Badger]

You will want something like this.

[Adabi_Raihan]

it gives me this error

[ERROR][logstash.filters.ruby ] Ruby exception occurred: Invalid FieldReference: [events][parameters_split]USER_EMAIL

any idea ?

this I what I wrote

>    if [events][parameters] {
>       ruby {
>         code => '
>           event.get("[events][parameters]").each { |a|
>             name = a["name"]
>             value = a["value"]
>             event.set( "[events][parameters_split]#{name}", value)
>           }
>         '
>       }
>     }

[Adabi_Raihan]

nevermind, find the issue just give [ ] to #{name}

final:

   if [events][parameters] {
      ruby {
        code => '
          event.get("[events][parameters]").each { |a|
            name = a["name"]
            value = a["value"]
            event.set("[events][parameters_split][#{name}]", value)
          }
        '
      }
    }

Thanks Badger !