Create Empty array when logstash outputs

Elastic Stack Logstash
1 
input {
    jdbc {
        jdbc_driver_library => "..."
        jdbc_driver_class => "com.mysql.jdbc.Driver"
        jdbc_paging_enabled => true
        tracking_column => "unix_ts_in_secs"
        use_column_value => true
        tracking_column_type => "numeric"
        schedule => "* * * * *" 
        statement => "SELECT id, name, sex, animal_id, UNIX_TIMESTAMP(el_time) AS unix_ts_in_secs FROM users
        WHERE (UNIX_TIMESTAMP(el_time) > :sql_last_value AND el_time < NOW())
        ORDER BY el_time ASC"
    }
}

filter {
    mutate {
        copy => {
            ...
        }
        remove_field => ["..."]
        add_field => { "previous_matches" => "[]" }
    }
}

output {
    elasticsearch {
        hosts => ["localhost:9200"]
        index => "..."
        document_id => "%{[@metadata][_id]}"
    }
    stdout {
        codec => "rubydebug"
    }
}

What I want to do

I would like to create a empty array (field'previous_matches') when logstash outputs to elasticsearch

What is actually happening

Seems like elasticsearch interprets field "previous_matches" as string!

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.