Hi!
I want to know if there is any filter plugin that can create multiple events/docs from a single line.
For example, in my input data I have a field with the next line:
"field_name":"AAA:AAAA:AAAA;BBBB:BBB:BBB;CCCC:CCCC:CCC"
and I pretend to split by ";" to create new events like:
{"@timestamp" => "XXXX",
"@version" => "1",
"message" => "AAA:AAAA:AAAA" }
{"@timestamp" => "XXXX",
"@version" => "1",
"message" => "BBBB:BBB:BBB" }
{"@timestamp" => "XXXX",
"@version" => "1",
"message" => "CCCC:CCCC:CCC" }
I already try the multiline codec and works beautiful in the input part, but in the filter part it give me:
"tags" => [
[0] "multiline"
]
The code in the filter part is:
multiline {
pattern => ";"
negate => true
what => "next"
source => "field_name"
}
Thanks