I have 2 input fields
"id" => [
[0] "0",
[1] "3",
[2] "5",
[3] "7",
[4] "9"
],
"data" => [
[0] "01",
[1] "03",
[2] "05",
[3] "07",
[4] "09"
],
My requirement is that I want to get the index of "id" field where value is "7".
And then use the index value(of "7") to get the value in "data" for the same index(which should be 07)
To extract the index from id, below is the ruby code
ruby {
code => "
event['IntegerValue'] = event['id'].index('7')
"
}
It gives me the value 3 which is the index value in integer.
Now to get the value of data at same index, below is the ruby code
event['RCODE'] = event['[data][IntegerValue]']
It always returns me the value at 0 index. Whatever I may try.
I also tried mutate filter
mutate{
add_field => { "RCODE" => "%{[data][IntegerValue]}" }
}
It again returns me value at 0 index which is 01 which is wrong. My desired output is 07 (in this case).
If I pass static index value I get the correct response
mutate{
add_field => { "RCODE" => "%{[data][3]}" }
}
Output is 07 which is the desired one.
Please help what am I doing wrong here.