Using a field value as a field name

[AdAndre]

Hi,

I would like to transform a json in this way (I simplified a little the data for the example) :

Before : {"gauge":{"value":973.0},"kind":"absolute","name":"scrape_samples_scraped","tags":{"job":"node_exporter"}}

After: {"fields":{"job":"node_exporter","metric_name:scrape_samples_scraped":973.0}}

I tried to do it with a remap but I don't manage to get the part with the metric_name inside the field name : "metric_name:scrape_samples_scraped":973.0

So, is there a way with vector to use a field value as, or inside a field name ?

I tried to get around that by using the parse_key_value() function, but then the metric value field becomes a String, and I can't convert it to an Int because the field name will not always be the same...

What I tried : .fields = merge!(del(.tags),parse_key_value!("metric_name:" + to_string!(.name) + "=" + to_string!(.gauge.value),"="))

What I got : {"fields": { "job": "node_exporter", "metric_name:scrape_samples_scraped": "973" }}

Please tell me if you have any idea,

Thanks

[jszwedko]

Hi @AdAndre !

It does appear like this isn't quite possible yet. I thought something like:

$ . = {"gauge":{"value":973.0},"kind":"absolute","name":"scrape_samples_scraped","tags":{"job":"node_exporter"}}
{ "gauge": { "value": 973 }, "kind": "absolute", "name": "scrape_samples_scraped", "tags": { "job": "node_exporter" } }

$ { "fields": merge(foo.tags, { "metric_name:" + .name: .value }) }

error[E203]: syntax error
  ┌─ :1:53
  │
1 │ { "fields": merge(foo.tags, { "metric_name:" + .name: .value }) }

Might work, but it didn't. I think this is related partially related to #7050 , but a bit different. I'll convert this discussion into an issue for tracking.

[AdAndre]

Hi @jszwedko, thank you for your answer !

My first tries were similar to your idea, but they also failed. I think it would be great to be able to do the { "metric_name:" + .name: .value } thing.

Well, #7050 definitely seems different, but it could probably do the work with a few tricks, like what I did with the parse_key.

I'll keep an eye on this 👍