Transforming objects with key and value fields into simple fields

Elastic Stack Logstash
1

Logstash is receiving events which include a list of json objects, each with two fields key and value:

    {
      "details": [
        { "key": "foo", "value": "foo value" },
        { "key": "bar", "value": "bar value" },
        { "key": "baz", "value": "baz value" }
      ]
    }

I would like to transform this field into a cleaner and more searchable format such as:

    {
      "details_parsed": {
        "foo": "foo value",
        "bar": "bar value",
        "baz": "baz value"
      }
    }

I have not been able to find a logstash filter plugin which will help me very much with this transformation. I'm sure I could use a ruby filter, but would rather use a cleaner solution if one exists.

Thanks for any help

2

I would do it in a ruby filter. Something like this.

1 Like
3

Thanks, it looks like that is the best option.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.