I have this log with message field contains this line
"message":"name="Alert notification" event_id=123 alert_name="alert 1234" ipaddr="192.168.0.1" object_name="localhost.local""
I want to add new field with the value after = sign so it will look like this
"alert_name":"alert 1234",
"object_name":"localhost.local",
"ipaddr":"192.168.0.1"
I've tried using this kind of grok filter but it grab the whole string ("alert_name":"alert_name"="alert 1234")
grok {
match => { "message" => "%{WORD:method1} %{WORD:method2} %{WORD:method3}" }
}
How to only pass value after = to this new field?
Related
When creating a new record, I am trying to fill in a field which is LONGTEXT. I use it to store json data.
$newRecord = new Profile([
'info' => '[]',
]);
$newRecord->save();
In the database, the data is being stored as "[]" (with quotes around the data entered) instead of [] which is breaking logic in my application. How can I make sure it enters the data correctly? Also, I have tried setting [] as default value for the LONGTEXT column but MySQL returns an error saying it's not allowed for LONGTEXT columns.
Figured it out. 'info' column in this case is casted as an array in the Profile Model:
protected $casts = [
'info' => 'array',
];
Using an empty array [] rather than '[]' as a String fixed the issue:
$newRecord = new Profile([
'info' => [],
]);
I have a problem with logstash parsing, I need to extract a field separated by hyphen:
if "[payload][text][code][session-id]" {
mutate {
add_field => { "session-id" => "%{[payload][text][code][session-id]}" }
}
}
the conditional is working because the quotes, but when I run the filter, it returns:
t session-id: %{[payload][text][code][session-id]}
and what I expect is:
t session-id: HK5wfPQgzkKHmgzVF
how I can scape the hypens in the payload field?
Your conditional is wrong, putting the field name between double quotes will make it a string and it will always be true, so your mutate filter will always run and add the field session-id with the content of the field [payload][text][code][session-id], if the field does not exist, the string %{[payload][text][code][session-id]} will be added into session-id as the value of the field.
Your conditional should be if [payload][text][code][session-id] without double quotes.
You can reproduce this behavior with the following test pipeline
input {
generator {
message => "HK5wfPQgzkKHmgzVF"
count => 1
}
}
filter {
dissect {
mapping => {
"message" => "%{[payload][text][code][session-id]}"
}
}
if "[payload][text][code][session-id]" {
mutate {
add_field => { "session-id" => "%{[payload][text][code][session-id]}"}
}
}
}
output {
stdout { }
}
Running this pipeline will give you the field session-id with the value HK5wfPQgzkKHmgzVF because the field [payload][text][code][session-id] exists and your conditional is always true, if you change the name of the field to [payload][text][code][session-id-test] in the dissect block and run the pipeline again, the value of session-id will now be %{[payload][text][code][session-id]}.
Remove the double quotes from the conditional and it will only be true if the field [payload][text][code][session-id] really exists.
I have a JSON return (is it a hash? array? JS object?) where every entry is information on a person and follows the following format:
{"type"=>"PersonSummary",
"id"=>"123", "properties"=>{"permalink"=>"personname",
"api_path"=>"people/personname"}}
I would like to go through every entry, and output only the "id"
I've put the entire JSON pull "response" into "result"
result = JSON.parse(response)
then, I'd like to go through result and do print the ID and "api_path" of the person:
result.each do |print id AND api_path|
How do I go about doing this in Ruby?
The only time you would need to use JSON.parse is if you have a string you need to parse into a Hash. For Example:
result = JSON.parse('{ "type" : "PersonSummary", "id" : 123, "properties" : { "permalink" : "personname", "api_path" : "people/personname" } }')
Once you have the Hash, result could be accessed by giving it the key, like result[:id] or result['id'] (both will work), or you can iterate through the hash too using the following code.
If you need to access the api_path value you would do so by using result['properties']['api_path']
result = { 'type' => 'PersonSummary', 'id' => 123, 'properties' => { 'permalink' => 'personname', 'api_path' => 'people/personname' } }
result.each do |key, value|
puts "Key: #{key}\t\tValue: #{value}"
end
You could even do something like puts value if key == 'id' if you just want to show certain values.
I've found a bunch of topics that were very similar, but I'm just missing something. >.<
Basically, I'm trying to create the a variable called $db_url with the database credentials, host address, and name.
When trying to extract the value of a hash within a hash, I'm getting the following error:
`[]': can't convert String into Integer (TypeError)
on this line:
$credentials = $svc_details["credentials"]
Here's the context:
if (ENV['VCAP_SERVICES'])
$vcap = JSON.parse(ENV['VCAP_SERVICES'])
$svc_details = $vcap["mysql-5.1"]
$credentials = $svc_details["credentials"]
$host = $credentials["host"]
$username = $credentials["username"]
$password = $credentials["password"]
$database = $credentials["name"]
$port = $credentials["port"]
$db_url = "mysql://#{$username}:#{$password}##{$host}/#{$database}"
end
configure do
Sequel.connect($db_url || ENV['DATABASE_URL'] || 'sqlite://blog.db')
require 'ostruct'
Blog = OpenStruct.new(
:title => 'My Title',
:author => 'My Name',
:url_base => ENV['SITE_URL'],
:admin_password => 'My Password',
:admin_cookie_key => 'cookie_key',
:admin_cookie_value => 'cookie_value',
:disqus_shortname => nil
)
end
EDIT:
Here's an example of the JSON I'm trying to work:
{"mysql-5.1":[
{
"name":"mysql-4f700",
"label":"mysql-5.1",
"plan":"free",
"tags":["mysql","mysql-5.1","relational"],
"credentials":{
"name":"d6d665aa69817406d8901cd145e05e3c6",
"hostname":"mysql-node01.us-east-1.aws.af.cm",
"host":"mysql-node01.us-east-1.aws.af.cm",
"port":3306,
"user":"uB7CoL4Hxv9Ny",
"username":"uB7CoL4Hxv9Ny",
"password":"pzAx0iaOp2yKB"
}
},
{
"name":"mysql-f1a13",
"label":"mysql-5.1",
"plan":"free",
"tags":["mysql","mysql-5.1","relational"],
"credentials":{
"name":"db777ab9da32047d99dd6cdae3aafebda",
"hostname":"mysql-node01.us-east-1.aws.af.cm",
"host":"mysql-node01.us-east-1.aws.af.cm",
"port":3306,
"user":"uJHApvZF6JBqT",
"username":"uJHApvZF6JBqT",
"password":"p146KmfkqGYmi"
}
}
]}
I'm a programming newbie, so I apologize if I'm missing information or don't understand something.
The can't convert String into Integer (TypeError) error is because $svc_details is an array i.e. a list of entries where you use a numeric index to select the one you want but you're trying to use a string "credentials" as an index for the array.
If you look at your JSON you'll see that "mysql-5.1" at the start refers to an array (enclosed by the [] brackets) with 2 entries in it: the one that begins { "name":"mysql-4f700"... and the second one that begins { "name":"mysql-f1a13"...
This means that when you write:
$svc_details = $vcap["mysql-5.1"]
then $svc_details is an array with 2 elements so you can't go straight to the "credentials"
If you know whether you want the first or second entry then you can use $svc_details = $vcap["mysql-5.1"][0] or $svc_details = $vcap["mysql-5.1"][1] to select the appropriate section of the JSON, or you could write some code to find the entry with a particular name.
This is my dropdownlistFor
#Html.DropDownListFor(m => m.objTicket.DepartmentId, new SelectList(Model.objTicket.Departments, "DepartmentId", "Department"),
"-- Select Department--", new { id = "Deptment"}, disabled="disabled")
How can I pass the value which is already stored in objTicket.DepartmentId ?
If i change remove disabled ="disabled", i get my correct value.
Form fields are submitted using Names instead of Ids. Disabled controls values wont be submitted by browsers. Place a #Html.HiddenFor field with same name and different Ids as given below.
#Html.DropDownListFor(m => m.objTicket.DepartmentId, new SelectList(Model.objTicket.Departments, "DepartmentId", "Department"),Department--", new { id = "Deptment"}, disabled="disabled")
#Html.HiddenFor(m => m.objTicket.DepartmentId, new { id="Deptment2" })