convert string to array based on pattern in logstash

问题

My original data.

{
  message: {
      data: "["1,2","3,4","5,6"]"
  }
}

Now I want to convert value of data field to an array. So it should become:

{
  message: {
      data: ["1,2", "3,4", "5,6"]
  }
}

By using

mutate {
    gsub => ["data", "[\[\]]", ""]
  }

I got rid of square brackets.

After this, I tried splitting based on commas. But that won't work. Since my data has commas as well.

I tried writing a dissect block but that is not useful.

So how should I go ahead with this?

回答1:

Have you tried the json filter? If the data field always contains valid json data, you use the json filter like this:

json {
    source => "data"
    target => "data"
}

Using target => "data" will overwrite the data field.

来源：https://stackoverflow.com/questions/54437344/convert-string-to-array-based-on-pattern-in-logstash