Apply elastic plugin on array items

Elastic Stack Logstash
1

Hello,
I need to apply a search/translate for a field which optionally contains multiple values:

  event_id;ext_ref;  ... other fields
  "#123";"ref3";  . . . 
  "#244";"ref2|ref7";  . . .

the second field should be split (if it contains '|') and each of the resulting values looked up with elasticsearch plugin to enrich the event with additional fields.

The resulting doc should look like

  _id: "244",
  "_source": {
     "id": "244"
     "ext_ref" : [ "ref2", "ref7" ]
     "elk_fld1" : [ "data for ref2", "data for ref7" ]
     "elk_fld2" : [ "more data for ref2", "more data for ref7" ]
     . . .
 }

Is there any way to iterate over all the elements of ext_ref, other than

if [ext_ref][0] { elasticsearch {  .   .   .  } }
if [ext_ref][1] { . . . }
 . . .
if [ext_ref][n] { . . . }

?

2

I guess you'll have to use the Ruby plugin and write Ruby code to iterate the collection...

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.