@Christian_Dahlqvist someone do this,
filter {
split {
field => "results"
}
split {
field => "[results][series]"
}
split {
field => "[results][series][values]"
}
if[name]== "cpu"
{
ruby
{
#event.set(event.get("[results][series][columns][0]"),event.get("[results][series][values][0])")
code => '
event.set(event.get("[results][series][columns][0]"),event.get("[results][series][values][0]"))
'
}
}
any idea?