Transforming array of objects

[AlessandroKP (Alessandro)]

Hi all,

we are trying to process an event with Logstash that is generated by http_poller input.
The event has the following structure:

{
	"data": [
		{
			"name": "key1",
			"value": "A"
		},
		{
			"name": "key2",
			"value": "B"
		},
		{
			"name": "key3",
			"value": "C"
		}
	]
}

We want to transform the event into:

{
	"key1": "A",
	"key2": "B",
	"key3": "C"
}

Is there a filter plugin that is able to perform this action?
If there is not, do we have to write a custom plugin?

[Badger]

Use a ruby filter. This should get you started.

[AlessandroKP (Alessandro)]

Hi @Badger,

thanks for you reply.

We applied the solution you pointed at and it worked like a charm!

Here it is the configuration of the Logstash pipeline:

input {
	...
}

filter {
	if [data] {
		ruby {
			code => '
			event.get("[data]").each { |dataElement|
				name = dataElement["name"]
				value = dataElement["value"]
				event.set( name, value)
			}
			'
		}		
	}
}

output {
	...
}

Thank you very much

Alessandro