XML plugin + split + ruby code to generate dynamic fields

Elastic Stack Logstash
1

Hi,
I have a compplex XML with information about phone network cells we need to parse. I managed to ingest the data using the xml and the split filter in order to have the desired information in separate documents into elastic. So far, so god
Now I have this problem. The documents contains a nested field called poc,mi like this:

{
  "mt": [
    "pmLossOfFrame",
    "pmLossOfSignal",
    "pmSfpTxPower",
    "pmSfpRxPower",
    "pmSfpTxBias",
    "pmBitError"
  ],
  "mv": {
    "moid": [
      " 1,1,1,1,1,F"
    ],
    "r": [
      "0",
      "0",
      "0",
      "0",
      "0",
      "0,0,0,0,0,0"
    ]
  }
}

I need to extract the mt value and the r values into arrays inside a ruby code.
I'have tried several ways but no luck

Thank you
Regards
Ana

2

What structure do you want to end up with?

3

Hi @Badger
I solved using the following code (any suggestion is welcome)

  ruby {
            code => "
                     param=event.get('[poc][mi]')[0]['mt']
                     values=event.get('[poc][mi]')[0]['mv']['r']
                     array=[param, values].transpose
                     array.each {|x| event.set(x[0],x[1])}
            "
    }

The structure I need to end up with is:
the values of the mt array as individuals fields whose value is in the r array matching positionally (it is a very ugly XML). See attached.

Any suggestion is welcome
Regards
Ana

structure
structure.JPG861×586 42.4 KB

4

That's the way to do it. Personally I would have written it slightly differently, but it is six of one and half a dozen of the other.

param.each_index {|x| event.set(param[x],values[x])}