Append new information to a field and turn it an array

Elastic Stack Logstash
1

Is it possible to use logstash to send a list of information into a document's fields and turn it into an array?

Example
Index name: People
Type: Eastern
Document: Country1
Field: BadPeople
Values: scammer

can I use logstash to make it into something like this

Example
Index name: People
Type: Eastern
Document: Country1
Field: BadPeople
Values: scammer, gangster, prankster, mafia

2

Logstash supports array fields, yes. If you use an add_field option to any of Logstash's filter plugins, adding to the same field twice will turn it into an array field.

1 Like
3

Base on the previous example. How can I use logstash to parse the following to get the desired result?

Raw Text in Text File
scammer
gangster
prankster
mafia

Desired End Result
Index name: People
Type: Eastern
Document: Country1
Field: BadPeople
Values: scammer, gangster, prankster, mafia

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.