Clone multiple JSON events from input source count

Elastic Stack Logstash
1

Receiving JSON input lines with count value as one of the fields. Count value should be used to clone elasticsearch events before ingesting in elasticsearch. Tried ruby code below to loop the count and could not get the clone to work. Please advise sample Ruby code to process this request and ingest in Elasticsearch.

Logstash version : 5.6.8

Input line : { "key1" : value 1, "key2" : value2, "key 3" : new_req}

Logstash filter code.

filter{
            ruby { code => "event.set('clone_count', Integer(event.get('new_req') - 1")) }
            mutate { add_tag => [ "cloneme" ] }
            if "cloneme" in [tags] {
               if "cloned" not in [tags] {
                 mutate { add_tag => [ "cloned" ] }
                 ruby {
                        code => "
                           for i in 0..Integer(event.get('clone_count'))
                              clone {
                                  clones => ["cloned"]
                              }
                           end
                         "
                      }
              }
        }
}
2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.