Well I changed it using something like this:
if ([json][transactionElement]) {
mutate {
add_field => {
tags => "treated"
}
}
aggregate {
task_id => "%{[json][correlationId]}"
code => "
map['MapTransactionElement'] ||= []
map['MapTransactionElement'] << {
'conca_api_correlationId' => event.get('[json][correlationId]'),
'conca_api_hostname' => event.get('[json][processInfo][hostname]'),
'conca_api_instance' => event.get('[json][processInfo][groupName]'),
'conca_api_service_name' => event.get('[json][processInfo][serviceName]')
}
event.cancel()
"
}
drop {}
but even with this in my index in kibana I can see all the logs untreated.
like this log:
{
"_index": "api-test-logstash-2019.19",
"_type": "doc",
"_id": "pXjbjWoBWdaL9cShGlkq",
"_version": 1,
"_score": null,
"_source": {
"@version": "1",
"prospector": {
"type": "log"
},
"@timestamp": "2019-05-06T15:54:00.593Z",
"tags": [
"treated"
],
"source": "/home/selfdeploy/Manager__LAN/group-9_instance-76_traffic_2019-05-02-21.log",
"input": {
"type": "log"
},
"log": {
"file": {
"path": "/home/selfdeploy/Manager__LAN/group-9_instance-76_traffic_2019-05-02-21.log"
}
},
"offset": 20660340,
"app": "api",
"message": "{\"timestamp\":1556784659459,\"correlationId\":\"13a6ca5c3d08274dfab2c0df\",\"processInfo\":{\"hostname\":\"a98sv068api1p\",\"domainId\":\
"3c03047f-74bb-48a0-a625-a7fa4f04ef9e\",\"groupId\":\"group-9\",\"groupName\":\"FiltrageLan\",\"serviceId\"
:\"instance-76\",\"serviceName\":\"FiltrageLan\",\"version\":\"v7.5.3-Internal\"},\"transactionSummary\":{\"path\":\"/\", \"protocol\":\"https\", \"protocolSrc\":\"8443\", \"status\":\"success\", \"serviceContexts\":[]}}"
},
"fields": {
"@timestamp": [
"2019-05-06T15:54:00.593Z"
]
},
"sort": [
1557158040593
]
}