_ingest processor

Elastic Stack Elasticsearch
1

I am attempting to do what I think should be a simple ingest processor pipeline.

From filebeat I am doing the following

{
"description": "OpenAM Authentication Access Logging",
"processors": [{
"set" : {
"field": "type",
"value": "amAuthentication.access_pipeline"
},
"split": {
"field": "message",
"separator": "\t"
},
"set": {
"field": "openam.data",
"value": "{{message.1}}"
}
}
],
"on_failure": [
{
"set": {
"field": "error",
"value": "{{ _ingest.on_failure_message }}"
}
}
]
}

But my value in elasticsearch is

"openam": {
"data": ""
},

How can I access the individual array elements of the initial split?

Thanks
Zach

2

What value is this?

3

I was hoping it would be the first element of the array returned from the split processor run on the message field.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.