Create multiple events/docs from a single line


(Luís Ricardo da Costa Carvalho) #1

Hi!
I want to know if there is any filter plugin that can create multiple events/docs from a single line.

For example, in my input data I have a field with the next line:

"field_name":"AAA:AAAA:AAAA;BBBB:BBB:BBB;CCCC:CCCC:CCC"

and I pretend to split by ";" to create new events like:

{"@timestamp" => "XXXX",
"@version" => "1",
"message" => "AAA:AAAA:AAAA" }

{"@timestamp" => "XXXX",
"@version" => "1",
"message" => "BBBB:BBB:BBB" }

{"@timestamp" => "XXXX",
"@version" => "1",
"message" => "CCCC:CCCC:CCC" }

I already try the multiline codec and works beautiful in the input part, but in the filter part it give me:

"tags" => [
[0] "multiline"
]

The code in the filter part is:

multiline {
pattern => ";"
negate => true
what => "next"
source => "field_name"
}

Thanks


(system) #2