How to ingest kv field values as seperate records in kibana

Elastic Stack Logstash
1

Hi,

I'm trying to ingest API data into kibana with Logstash. In this i'm not getting the value as expected.

My config file is

input {
stdin{}
http_poller {
urls => {
q1 => {
method => get
user => "me"
password => "mypassword"
url => "myurl"
headers => {
Accept => "application/json"
"Content-Type" => "application/json"
}
}
}
keepalive => false
request_timeout => 900000
socket_timeout => 1800
codec => "plain"
# Supports "cron", "every", "at" and "in" schedules by rufus scheduler
schedule => { cron => "*/5 * * * * UTC"}
metadata_target => "http_poller_metadata"
}
}
filter {
kv {
remove_char_key => "{}\+"
remove_char_value => "{}\+"
field_split => ","
value_split => ":"
source => message
}
mutate {
remove_field => "message"
}
}
output{
stdout {
codec => rubydebug
}
elasticsearch {
action => "index"
index => "myindex"
hosts => ["localhost:9200"]
}
}

i'm getting the output as follows:
""Teams_AgentAssignment_connectedOn"" => [
[0] ""2020-04-02T15:45:32.698"",
[1] ""2020-04-02T15:34:55.480""
],
""Dialogs_ChatSession_isAbandoned"" => [
[0] "false",
[1] "false"
],
""Teams_AgentAssignment_timeStamp"" => [
[0] ""2020-04-02T15:45:32.698"",
[1] ""2020-04-02T15:34:55.480""
],

but i need it as seperate records in kibana like:
"Teams_AgentAssignment_connectedOn" => "2020-04-02T15:45:32.698",
"Dialogs_ChatSession_isAbandoned" => "false",
"Teams_AgentAssignment_timeStamp" => "2020-04-02T15:45:32.698",

Please help me in getting this.

Thanks,
Mithuna

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.