Add an array using Mutate's add_field

Elastic Stack Logstash
1

Hi Guys,

I have a logstash pipeline where I am receiving a JSON file as HTTP input and forwarding it to output plugin.
I want to introduce below structure to input JSON :

"parentField": {
"field0": "value0",
"arrayName": [
{
"field1": "value1",
"field2": "value2"
}
]
}

To achieve that I am trying to use below filter ::
filter {
mutate {
add_field => { "[parentField][field0]" => "value0" }
add_field => { "[parentField][arrayName][0][field1]" => "value1" }
add_field => { "[parentField][arrayName][0][field2]" => "value2" }
}
}

But in this case [0] gets translated to a literal "0" and is being treated as a key instead of array index.
Meaning [parentField][arrayName][0][field1] gets translated to
parentfield => arrayname => "0" => {"field1" => "value1", "field2" => "value2"}

What I am trying to achieve is
parentfield => arrayname => [[0] "field1"=>"value1", "field2" => "value2"]

How do I add an array of fields using mutate's add_filter?

2

You can add an array of strings using

mutate { add_field => { "foo" => [ "a",  "b" ] } }

I do not think you can add an array of hashes

1 Like
3

If I can not use mutate, is there any other way of achieving this?

4

You can do pretty much anything with a ruby filter.

5

cool, thanks!

I just found out that I can write plugins in java as well - https://www.elastic.co/guide/en/logstash/current/contributing-java-plugin.html

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.