Hi,
trying a simple stuff with logstash but could not get the expected result...
I have a multivalued Field like:
"PUB_WEIGHT": [
"3",
"4",
"6",
"8"
]
and in want to convert to
Field_1: 3
Field_2: 4
Field_3: 6
Field_4: 8
I try
add_field => { 'Filed_1' => "%{PUB_WEIGHT}[1]"}
or
match => { "PUB_WEIGHT" => "%{GREEDYDATA:Field_1},.*%{GREEDYDATA:Field_2},.*%{GREEDYDATA:Field_3},.*%{GREEDYDATA:Field_4}" }
It's fixed always 4 entries, I try some grok expression but could found, not sure if I need to count the carriage return