Logstash Filter code to extract values from array and populate into another array

38 Views Asked by At

I am a beginner to writing a logstash plugin and need to extract values from array in source json and construct another array of objects from the values. The input looks like this :

    "event": {
        "original": {
            "authorization_failure": false,
            "catalog_objects": [
                {
                    "name": "object 1",
                    "object_type": "TABLE",
                    "privilege": "ANY"
                }
                                {
                    "name": "object 2",
                    "object_type": "VIEW",
                    "privilege": "ANY"
                }
            ],
            "impersonator": null,
            "network_address": "10.11.12.14:33366",
            "query_id": "6d469f8278dabf95:0196fa0c00000000",
            "session_id": "19403fc52b77ef31:3597eb8e8102af8a",
            "sql_statement": "USE my_object",
            "start_time": "2023-10-30 21:08:24.323824",
            "statement_type": "USE",
            "status": "",
            "user": "user123"
        }
    }

and need to build the target structure that looks like this :

"MyRecord": {
    "data": {
            "sentences":[               
                {
                    "verb" : 
                    "objects":[
                        {
                            "name" : Object 1
                            "type" : TABLE
                        }
                        {
                            "name" : Object 2
                            "type" : VIEW
                        }
                    ]
                }
            ]
    }
}

I tried inline ruby code and I was able to build the empty target struture. But, wasn't sure how to populate the values. The size of the array can vary ( can be 0 or 1 or more).

Please help. Thanks for any help! Regards

Trying the inline ruby code didn't work as expected.

0

There are 0 best solutions below