does anyone know how to 'unflatten' fields in Cribl Stream?

Tony Reinke - Cribl

does anyone know how to 'unflatten' fields in Cribl Stream? For example: source.ip is a flattened field that I need to be modified as json: '{ "source": { "ip": "whatever" } }'

Original message in Cribl Community Slack Message:https://cribl-community.slack.com/archives/C02A9EQV61J/p1698617495203379

Jon Rust

I'd use a Code function. Something like this should do the trick:

var result = {};
for (let [key, value] of Object.entries(__e)) {
  if (key.includes('.')) {
    var segments = key.split('.'); // Split variable name into segments

    // Build the object structure
    var currentObject = result;
    for (var i = 0; i < segments.length; i++) {
      var segment = segments[i];
      if (!currentObject[segment]) {
        if (i === segments.length - 1) {
          // If it's the last segment, set the value
          currentObject[segment] = value;
        } else {
          // Otherwise, create an empty object for the next segment
          currentObject[segment] = {};
        }
      }
      currentObject = currentObject[segment];
    }
  }
};
Object.assign(__e,result)

Jon Rust

I'd use a Code function. Something like this should do the trick:

var result = {};
for (let [key, value] of Object.entries(__e)) {
  if (key.includes('.')) {
    var segments = key.split('.'); // Split variable name into segments

    // Build the object structure
    var currentObject = result;
    for (var i = 0; i < segments.length; i++) {
      var segment = segments[i];
      if (!currentObject[segment]) {
        if (i === segments.length - 1) {
          // If it's the last segment, set the value
          currentObject[segment] = value;
        } else {
          // Otherwise, create an empty object for the next segment
          currentObject[segment] = {};
        }
      }
      currentObject = currentObject[segment];
    }
  }
};
Object.assign(__e,result)