What would be the correct approach to break a field representing a json array into new data fields representing the various component elements?
For instance I have a field that contains the following data.
[{"id": "8b55e1b8-5c8a-40ac-81d9-ce0e0e46a044","type":"team"},{"id":"4e0f58af-6f41-4449-gf7e-a38a41684e1c","type":"user"}]
I want this broken out into new nested fields like so.
data.0.id
data.0.type
data.1.id
data.1.type
Regards
Badger
February 10, 2020, 7:20pm
2
Something like this (I haven't tested it)
json { source => "A field" target => "[@metadata][jsondata]" }
ruby {
code => '
a = event.get("[@metadata][jsondata]")
if a
a.each_index { |x|
event.set("data.#{x}.type", a[x]["type"])
event.set("data.#{x}.id", a[x]["id"]
}
end
'
}
After some minor modifications I was able to get this working as expected.
Thank you
system
(system)
Closed
March 9, 2020, 9:09pm
4
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.