Trouble splitting out json array into component elements

What would be the correct approach to break a field representing a json array into new data fields representing the various component elements?

For instance I have a field that contains the following data.

[{"id": "8b55e1b8-5c8a-40ac-81d9-ce0e0e46a044","type":"team"},{"id":"4e0f58af-6f41-4449-gf7e-a38a41684e1c","type":"user"}]

I want this broken out into new nested fields like so.


Something like this (I haven't tested it)

json { source => "A field" target => "[@metadata][jsondata]" }
ruby {
    code => '
        a = event.get("[@metadata][jsondata]")
        if a
            a.each_index { |x|
                event.set("data.#{x}.type", a[x]["type"])
                event.set("data.#{x}.id", a[x]["id"]

After some minor modifications I was able to get this working as expected.

Thank you

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.