Extract value from a multivalued field

[chriselk]

Hi,
trying a simple stuff with logstash but could not get the expected result...

I have a multivalued Field like:

"PUB_WEIGHT": [
      "3",
      "4",
      "6",
      "8"
    ]

and in want to convert to

Field_1: 3
Field_2: 4
Field_3: 6
Field_4: 8

I try

add_field => { 'Filed_1' => "%{PUB_WEIGHT}[1]"}

or

match => { "PUB_WEIGHT" => "%{GREEDYDATA:Field_1},.*%{GREEDYDATA:Field_2},.*%{GREEDYDATA:Field_3},.*%{GREEDYDATA:Field_4}" }

It's fixed always 4 entries, I try some grok expression but could found, not sure if I need to count the carriage return

[Cad]

Hi,

You can use the Split plugin Documentation.

Cad

[chriselk]

Great, Thank you for you quick help it's works now

[Badger]

@chriselk

add_field => { 'Filed_1' => "%{PUB_WEIGHT}[1]"}

That should be add_field => { 'Field_1' => "%{[PUB_WEIGHT][0]}"}