In the array / variable search, how most effective ?

[StefanSa]

I have a syslog device that does not send the hostname, but the serial number. Currently i create the hostname in number of devices over several "if" queries.
I would like to have this simpler if possible, but do not want to solve this via the enrichment option.
I imagine for example a variable / array like this:
.hosts =["SN01": "host01", "SN02": "host02"]

My question now how to search in this variable / array for the SN and then assign it to the matching host ?

[spencergilbert]

Slightly different from your existing example, but with this example event:

$ .
{ "message": "foobar", "serialnumber": "SN01" }

And a variable in VRL set to an object of serialnumber => hostname k/v's

$ hosts
{ "SN01": "host01", "SN02": "host02" }

You could use the get function to dynamically pull the value from your hosts object:

$ get!(hosts, [.serialnumber])
"host01"

[StefanSa]

@spencergilbert
Oh man, you are right about del(.host), i was completely blind here. :(
Everything works as it should. Sorry for your time.
But one question remains.
parse_url itself publishes a .host and overwrites me the key, how can i prevent that ?

[jszwedko]

Assuming you are merging the result of parse_url into your event, I'd recommend deleting or renaming it. You could consider something like:

url_parts = parse_url!(.some_url)
url_parts.url_host = del(url_parts.host)
. |= url_parts

[StefanSa]

Hi Jesse and Spencer you are a great team, thanks for the support here.
I'm off work soon and can't get this together, what I finally have to do here. Please help again, thank you !

if exists(.sophos.xg.url) {
   .url.original = del(.sophos.xg.url)
. |= parse_url!(.url.original, default_known_ports: true)
.url.domain = .host
.url.domain = del(.host)
.url.path = del(.path)
.url.scheme = del(.scheme)
.url.fragment = del(.fragment)
.url.password = del(.password)
.url.username = del(.username)
.url.port = del(.port)
.url.query = del(.query)
}

Have a nice weekend in advance.

[jszwedko]

Hi @StefanSa . As mentioned above, merging the result of parse_url directly into . will cause it to override host. You'll want to save the result of parse_url to an intermediate variable and then assign from there. For example:

url_parts = parse_url!(.some_url)
.url.domain = url_parts.host

[StefanSa]

Jesse perfect. Thanks