Skip to main content

does anyone know how to 'unflatten' fields in Cribl Stream? For example: source.ip is a flattened field that I need to be modified as json: '{ "source": { "ip": "whatever" } }'

Original message in Cribl Community Slack Message:https://cribl-community.slack.com/archives/C02A9EQV61J/p1698617495203379

I'd use a Code function. Something like this should do the trick:

var result = {};for (let [key, value] of Object.entries(__e)) {  if (key.includes('.')) {  var segments = key.split('.'); // Split variable name into segments  // Build the object structure  var currentObject = result;  for (var i = 0; i < segments.length; i++) {  var segment = segments[i];  if (!currentObject[segment]) {  if (i === segments.length - 1) {  // If it's the last segment, set the value  currentObject[segment] = value;  } else {  // Otherwise, create an empty object for the next segment  currentObject[segment] = {};  }  }  currentObject = currentObject[segment];  }  }};Object.assign(__e,result)

Reply