Forwarding the http input data to http output data

Elastic Stack Logstash
26

For the original data format the following might work

    mutate { gsub => [ "message", "\r", "" ] }
    mutate { split => { "message" => "
" } }
    ruby {
        code => '
            msg = event.get("message")
            if msg.is_a? Array
                while msg.length > 1 do
                    clone = event.clone
                    clone.set("message", msg.shift(2))

                    new_event_block.call(clone)
                end
                if msg.length > 0
                    logger.warn("Content is uneven")
                    event.set("message", msg)
                else
                    event.cancel
                end
            end
        '
    }
    if [message][1] {
        json { source => "[message][1]" }
        json { source => "[message][0]" target => "[@metadata][operation]" }
    }

and in the output section

if [@metadata][index] {
    elasticsearch {
        index => "%{[@metadata][operation][index][_index]}"
        ....

As noted before, this doesn't handle create, update, etc.