Converting Unique field names into values in key/value style

Hello everyone,
I Have documents with hundreds of fields with unique field names.
To avoid a huge mapping, I would like to convert them to the key/value style.

So out of something like

"deviceType" : "rfid",
"attempts": 1

i want to get something like

"properties" : [
{ "key" : "deviceType", "valueKeyword": "rfid" },
{ "key" : "attempts", "valueInteger": 1 },

Is this possible with logstash?

It's possible to do with a ruby filter. Something like

event.to_hash.each { |k, v|
  event.get('properties') << {'key' => k, 'valueKeyword' => v}

should work. It assumes that properties exists as an array field and that all values are strings so it'll take some adjustments.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.