I want to be able to create a new field if I find a specific value in <Code> tag.
For example, if code2 is present I want to create a field containing value2.
The thing is that I don't know how much <Dtl> tags I will have in the document.
With only one <Dtl> I could use a mutate filter like
if [Informations][Specs][Dtl][Code] and [Informations][Specs][Dtl][Code] == "code2" {
mutate {
add_field => {"[newField]" => "%{[Informations][Specs][Dtl][Value]}"}
}
}
However, I may have one but also many more <Dtl> tags.
I have been able to determine that this is a hash type with a ruby filter like
ruby {
code => "
case event.get('[Informations][Specs]')
when Hash
event.set('[Example]', 'This is a hash')
end
"
}
But I have no idea how to iterate over it and look for a specific code.
If anyone has an idea that would be a greate help !
Hello @Badger thanks for your answer.
I actually set force_array to false in an xml filter you are right, this is why the field is a hash (I didn't think it would have this impact)
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.