Hello team,
Can we drop json array values and send data to elasticsearch only for latest values.
Sample log line:
{
"@ad.context": "mydata",
"value": [
{
"app_name": "facebook",
"passwordCredentials": [
{
"endDateTime": "2025-01-01T11:07:13.6718884Z"
},
{
"endDateTime": "2024-11-15T11:07:13.6718884Z"
},
{
"endDateTime": "2024-10-28T11:07:13.6718884Z"
}
]
}
]
}
I have three passwordCredentials end date for one application I need to read only latest value i.e "endDateTime": "2025-01-01T11:07:13.6718884Z", and drop all other fields.