Trying to rename all elements inside array

Hi team,

i have tags array in my mongodb contacts collection, which contain mongodb ids, its store as
"tags":[{"$oid":"61822c908200c6b810bfee4d"},{"$oid":"61822c908200c6b810bfee4e"}]

i want to rename all elements of mongo ids inside tags array to "documentId" like i did for _id field :

filter {
mutate {
rename =>{ "[_id]" => "documentId"}
}
}

which give output as
"documentId" => "6188d0be3d5bd73e9bb78dd6",

i am just failing in renaming all element of tags array which is also array of mongodb ids

please help

i am stuck since five days

here my logdash config file

input {
mongodb{
uri => 'mongodb://127.0.0.1:27017/makeEmails'
placeholder_db_dir => '/opt/logstash/'
placeholder_db_name => 'logstash_sqlite.db'
collection => 'contacts'
batch_size => 5000
}
}
filter {
mutate {
rename =>{ "[_id]" => "documentId"}
}
}

output {
stdout {
codec => rubydebug
}
Elasticsearch {
action => "index"
index => "contact_log"
hosts => ["localhost:9200"]
user => "elastic"
password => "DYLDnjpyMHcnRbdfOckY"
codec => json
}
}

The following pipeline generates a sample document with an array called "tags", and then uses a ruby filter to replace the array elements with the "_id" field. It then outputs the result to stdout.

input {
# The generator creates an input event
    generator {
        lines => [
            '{"tags": ["a", "b", "c"], "_id": "6188d0be3d5bd73e9bb78dd6"}'
        ]
        count => 1
        codec => "json"
    }
}

filter {
  if [tags] {
    ruby {
      code => '
        event.get("tags").each_with_index do |item, index|
          event.set("[tags][#{index}]", event.get("_id"))
        end
      '
    }
  }
}

output {
    stdout { codec => "rubydebug" }
}

The output from executing the above code is:

{
           "_id" => "6188d0be3d5bd73e9bb78dd6",
      "@version" => "1",
    "@timestamp" => 2021-11-10T12:33:37.454Z,
          "tags" => [
        [0] "6188d0be3d5bd73e9bb78dd6",
        [1] "6188d0be3d5bd73e9bb78dd6",
        [2] "6188d0be3d5bd73e9bb78dd6"
    ],
          "host" => "New2020MacBook",
      "sequence" => 0
}

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.