Disallow duplicate key to be added on kv

[Justin_Cross]

I need to stop logstash from adding to ReceiverInfo more than once.

msg_attributes = ReceiverInfo=111111111,ReceiverInfo=22222222,ReceiverInfo=3333333333

It should add the first key/value and then no more. What I end up with is an array of 3 values for the ReceiverInfo field. At the end I should have one field called ReceiverInfo that contains 111111111.

kv {
    source => "msg_attributes"
    field_split => ","
}

Please help, thanks.

[magnusbaeck (Magnus Bäck)]

There doesn't appear to exist anything builtin to do this, but it's a simple operation with a ruby filter. A code snippet like this should work:

event.set('ReceiverInfo', event.get('ReceiverInfo')[0])

This assumes that the ReceiverInfo field exists and is an array with at least one element.