Create array in logstash -> elastic

Elastic Stack Logstash
1

I want to update documents, and add some of the fields to an array, e.g. with documents from json like

{ "name": "bill, "hobbies": "a" , "id": 1}

if I run logstash on more data like

{ "name": "ted, "hobbies": "a" , "id": 2}
{ "name": "bill, "hobbies": "c" , "id": 1}

I'd like to end up with ted having ["a"] as hobbies, and bill with ["a", "c"].

Looking at Creating/updating array of objects in elasticsearch logstash output and Add new values in the nested field - Logstash to Elasticsearch I've tried adding a script to the output plugin for elasticsearch

    script => '
      if (ctx._source.hobbies != null) {
          ctx._source.hobbies.add(params.event.get("hobbies"))
      } else {
          ctx._source.hobbies = [params.event.get("hobbies")]
      }'

This fails on the update because the field is a string;

"reason"=>"Unable to find dynamic method [add] with [1] arguments for class [java.lang.String]."}

How do I persuade it to be an array?
Is this possible? Is there another option?

Cheers.

1 Like
2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.