Logstash convert array of objects into array of terms

Question

EDIT -> I created a plugin for this, available here:

You can install with bin/logstash-plugin install logstash-filter-collect I have a logstash entry like:

 "cvals" => [
            [0] {
                   "text" => "cval something 1",
                "indices" => [
                    [0] 17,
                    [1] 29
                ]
            },
            [1] {
                   "text" => "cval something else 2",
                "indices" => [
                    [0] 17,
                    [1] 29
                ]
            }
            ...
            [n] {
                "text" => "cval more stuff n",
                "indices" => [
                    [0] 17,
                    [1] 29
                ]
            }

        ]

I would like to mutate it to be:

"cvals_terms" => [ "cval something 1", "cval something else 2", ..., "cval more stuff n"]

How do I do this with Logstash? I could do it with a block of Ruby code, but there has to be a way to do it with mutate or something I think...

jbmusso · Accepted Answer · 2018-07-03 10:14:31Z

0

Using logstash-oss v6.3.0, the following should work:

filter {
  ruby {
    code => "event.set('cvals_terms', event.get('cvals').map{ |n| n['text'] })"
  }
}

The downside is that you're coding in strings, which will hurt maintainability on the long run.

answered Jul 3, 2018 at 10:14

jbmusso

3,4661 gold badge27 silver badges36 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

mikeb Over a year ago

See the plugins in my original post, no need for custom code now.

jbmusso Over a year ago

This one-liner is provided as an alternative approach for people who seek a lightweight solution. Great job on the plugin though!

jbmusso Over a year ago

For moving Ruby code outside of Logstash pipeline, see also: elastic.co/blog/moving-ruby-code-out-of-logstash-pipeline

Collectives™ on Stack Overflow

Logstash convert array of objects into array of terms

1 Answer 1

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related