Flatten json and create dynamic field

[Jenni]

@elasticforme

used this code but didn't work

if [dataflow] {
   ruby {
     code => '
         kv = event.get("dataflow")
          kv.to_hash.each { |k,v|
         event.set(k, v)
      }
   '
   }
}

With "flatten out" you mean transfer those fields to the root level of your event, right? Then your code is close to the solution. But dataflow is an array with the actual data in the first entry. And you need to remove the field afterwards. I think it should be like this:

if [dataflow] {
   ruby {
     code => '
         event.get("[dataflow][0]").each { |k,v|
           event.set(k, v)
         }
         event.remove("dataflow")
   '
   }
}