Append an array element to logs coming from Logstash

Elastic Stack Elasticsearch
1

how to append an element to a particular field already containing an array? Actually, I am writing a painless script in the output part of the Logstash conf file. Code inside my conf file is:

input {
    kafka {
        bootstrap_servers => "http://kafka:9092"
        topics => "elasticIndexUpdateTopic"
        codec => json {}
    }
}

filter {
    mutate {
        remove_field => [ "@timestamp", "@version" ]
    }
}

output {
    if ([isAppend] or [isAppend] == "true") {
    elasticsearch {
      hosts => ["http://elasticsearch:9200"]
      index => "su-test"
      document_id => "%{[id]}"
      action => "update"
      doc_as_upsert => true 
      script_lang => "painless"
      script => "for(item in params.event.get('%{[field]}')){if(!ctx._source.%{[field]}.contains(item)){ctx._source.%{[field]}.add(item)}}"
      }
    }
    else {
      elasticsearch {
        hosts => ["http://elasticsearch:9200"]
        index => "su-test"
        document_id => "%{[id]}"
        action => "update"
        doc_as_upsert => true 
      }
  }
}
2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.