merge_array_hash.rb

# `params` is the value of the hash passed to `script_params` in the logstash configuration
def register(params)
  raise LogStash::ConfigurationError, "script_params => { fields => [ ... ] } is needed" unless params.key?('fields')
	@fields = Array(params['fields'])
  raise LogStash::ConfigurationError, "script_params => { merge_key => "..." } is needed" unless params.key?('merge_key')
  @merge_key = params['merge_key']
end

def filter(event)
  @fields.each do |field|
    value = event.get(field)
    update_event(value, event, field) if value.is_a?(Array)
  end
	return [event]
end

def update_event(ary, event, field)
  event.set field, merge_content(ary, event)
end

def merge_content(ary, event)
  new_ary = []
  ary.each do |value|
    if value.is_a?(Hash)
      merge_val = value[@merge_key]
      merge_hash = new_ary.find { |val| val.is_a?(Hash) && val[@merge_key] == merge_val } unless merge_val.nil?
      if merge_hash # existing hash value that includes the same merge key
        merge_hash.merge! value
      else
        new_ary << value
      end
    else
      new_ary << value
    end
  end
  new_ary
end

test "merging" do
  parameters do
    { "fields" => [ 'interfaces' ], 'merge_key' => "index" }
  end

  in_event do
    {
      "message" => "hello",
      "interfaces" => [
        {
          "some.value" => 'zzz', "another.value" => true, "index" => 42
        },
        {
          "some.value" => 'yyy', "index" => 12
        },
        {
          "some.value" => 'xxx', "different.value" => 32, "index" => 42
        }
      ]

    }
  end

  expect("one (same) event") do |events|
    events.size == 1
  end

  expect("merges the interfaces field") do |events|
    event = events[0]
    event.get('interfaces') == [
      {"index"=>42, "some.value"=>"xxx", "another.value"=>true, "different.value"=>32},
      {"index"=>12, "some.value"=>"yyy"}
    ]
  end
end