Use index and get value from an array in ruby logstash


(Aditya Srivastava) #1

I have 2 input fields

"id" => [
[0] "0",
[1] "3",
[2] "5",
[3] "7",
[4] "9"
],
"data" => [
[0] "01",
[1] "03",
[2] "05",
[3] "07",
[4] "09"
],

My requirement is that I want to get the index of "id" field where value is "7".
And then use the index value(of "7") to get the value in "data" for the same index(which should be 07)

To extract the index from id, below is the ruby code
ruby {
code => "
event['IntegerValue'] = event['id'].index('7')
"
}
It gives me the value 3 which is the index value in integer.

Now to get the value of data at same index, below is the ruby code
event['RCODE'] = event['[data][IntegerValue]']

It always returns me the value at 0 index. Whatever I may try.

I also tried mutate filter

mutate{
add_field => { "RCODE" => "%{[data][IntegerValue]}" }
}
It again returns me value at 0 index which is 01 which is wrong. My desired output is 07 (in this case).
If I pass static index value I get the correct response
mutate{
add_field => { "RCODE" => "%{[data][3]}" }
}
Output is 07 which is the desired one.
Please help what am I doing wrong here.


(Aditya Srivastava) #2

Ok. Got the solution.

event['RCODE'] = event['data'].at(event['IntegerValue'])


(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.