Converting Unique field names into values in key/value style

Elastic Stack Logstash
1

Hello everyone,
I Have documents with hundreds of fields with unique field names.
To avoid a huge mapping, I would like to convert them to the key/value style.

So out of something like

"deviceType" : "rfid",
"attempts": 1

i want to get something like

"properties" : [
{ "key" : "deviceType", "valueKeyword": "rfid" },
{ "key" : "attempts", "valueInteger": 1 },
]

Is this possible with logstash?

2

It's possible to do with a ruby filter. Something like

event.to_hash.each { |k, v|
  event.get('properties') << {'key' => k, 'valueKeyword' => v}
}

should work. It assumes that properties exists as an array field and that all values are strings so it'll take some adjustments.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.