We have updated our Terms of Service, Code of Conduct, and Addendum.

does anyone know how to 'unflatten' fields in Cribl Stream?

Options
Tony Reinke - Cribl
Tony Reinke - Cribl Posts: 134 admin
edited October 2023 in General Discussions

does anyone know how to 'unflatten' fields in Cribl Stream? For example: source.ip is a flattened field that I need to be modified as json: '{ "source": { "ip": "whatever" } }'

Original message in Cribl Community Slack Message:https://cribl-community.slack.com/archives/C02A9EQV61J/p1698617495203379

Tagged:

Best Answer

  • Jon Rust
    Jon Rust Posts: 431 mod
    Answer ✓
    Options

    I'd use a Code function. Something like this should do the trick:

    var result = {};
    for (let [key, value] of Object.entries(__e)) {
      if (key.includes('.')) {
        var segments = key.split('.'); // Split variable name into segments
    
        // Build the object structure
        var currentObject = result;
        for (var i = 0; i < segments.length; i++) {
          var segment = segments[i];
          if (!currentObject[segment]) {
            if (i === segments.length - 1) {
              // If it's the last segment, set the value
              currentObject[segment] = value;
            } else {
              // Otherwise, create an empty object for the next segment
              currentObject[segment] = {};
            }
          }
          currentObject = currentObject[segment];
        }
      }
    };
    Object.assign(__e,result)
    

Answers

  • Jon Rust
    Jon Rust Posts: 431 mod
    Answer ✓
    Options

    I'd use a Code function. Something like this should do the trick:

    var result = {};
    for (let [key, value] of Object.entries(__e)) {
      if (key.includes('.')) {
        var segments = key.split('.'); // Split variable name into segments
    
        // Build the object structure
        var currentObject = result;
        for (var i = 0; i < segments.length; i++) {
          var segment = segments[i];
          if (!currentObject[segment]) {
            if (i === segments.length - 1) {
              // If it's the last segment, set the value
              currentObject[segment] = value;
            } else {
              // Otherwise, create an empty object for the next segment
              currentObject[segment] = {};
            }
          }
          currentObject = currentObject[segment];
        }
      }
    };
    Object.assign(__e,result)