Create new records from old one

Elastic Stack Logstash
1

Hello!

I have JSON at input

{
  "data:{
    "id":"123"
  },
  "message":[
    "event1",
    "event2",
    "event3"
  ],
  "source":"abc"
}

Is it possible to make three different events based on "event1", "event2" and "event3" like

{
  "data:{
    "id":"123"
  },
  "event1",
  "source":"abc"
}

and so on ?

2

You can use a split filter to split the array into three different events. I am not sure what you mean by

"event1",

A hash entry needs a key and a value.

1 Like
3

@Badger

the input JSON is

{
  "data:{
    "id":"123"
  },
  "message":[
    "2021-12-15T19:50:00-0700 [INFO]: message1",
    "2021-12-15T19:51:00-0700 [INFO]: message2"
  ],
  "source":"abc"
}

So I want to get two events

{
  "data:{
    "id":"123"
  },
  "2021-12-15T19:50:00-0700 [INFO]: message1",
  "source":"abc"
}

and

{
  "data:{
    "id":"123"
  },
  "2021-12-15T19:51:00-0700 [INFO]: message2",
  "source":"abc"
}
4

Neither of those would be valid JSON.

5

@Badger when I parse it with json filter I get

"source" => "abc",
      "@version" => "1",
      "sequence" => 0,
          "host" => "localhost.localdomain",
       "message" => [
        [0] "2021-12-15T19:50:00-0700 [INFO]: message1",
        [1] "2021-12-15T19:51:00-0700 [INFO]: message2"
    ],
    "@timestamp" => 2021-12-15T14:48:06.259Z,
          "data" => {
        "id" => "123"
    }
6

And if you use a split filter you can change that to two events that look like

      "host" => "localhost.localdomain",
   "message" => "2021-12-15T19:50:00-0700 [INFO]: message1",
"@timestamp" => 2021-12-15T14:48:06.259Z,
      "data" => {
    "id" => "123"
}

But you cannot convert them to be

      "host" => "localhost.localdomain",
   "2021-12-15T19:50:00-0700 [INFO]: message1",
"@timestamp" => 2021-12-15T14:48:06.259Z,
      "data" => {
    "id" => "123"
}

which is what you are asking for.

1 Like
7

@Badger this one is what I want

"host" => "localhost.localdomain",
   "message" => "2021-12-15T19:50:00-0700 [INFO]: message1",
"@timestamp" => 2021-12-15T14:48:06.259Z,
      "data" => {
    "id" => "123"
}

but when I use split filter after json filter

mutate {
    split => { "[message]" => "," }
  }

I get the error mutate - Can't split something that isn't a string

8

I've used wrong filter :man_facepalming:
It should be

split {
    field  => "message"
  }
9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.