Agrregate Filter For each

Elastic Stack Logstash
1

So I have this code:

filter {
aggregate {
task_id => "%{id}"
code => "
map['Author'] ||= []
event.to_hash.each do |key,value|
map[key] = value unless map.has_key?(key)
map[key] << value if map[key].is_a?(Array)
end
"
push_previous_map_as_event => true
timeout => 5
timeout_tags => ['aggregated']
}
if "aggregated" not in [tags] {
drop {}
}
}

But I want to see if value is already in array before merginf to array.

Can someone help me please?

thanks

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.