_ingest processor

I am attempting to do what I think should be a simple ingest processor pipeline.

From filebeat I am doing the following

{
"description": "OpenAM Authentication Access Logging",
"processors": [{
"set" : {
"field": "type",
"value": "amAuthentication.access_pipeline"
},
"split": {
"field": "message",
"separator": "\t"
},
"set": {
"field": "openam.data",
"value": "{{message.1}}"
}
}
],
"on_failure": [
{
"set": {
"field": "error",
"value": "{{ _ingest.on_failure_message }}"
}
}
]
}

But my value in elasticsearch is

"openam": {
"data": ""
},

How can I access the individual array elements of the initial split?

Thanks
Zach

What value is this?

I was hoping it would be the first element of the array returned from the split processor run on the message field.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.