How to loop over an array in logstash


(Mosh) #1

Hi,
I was wondering what is the correct syntax for what i'm trying to achieve.
I'm splitting a field using a separator, the value may be splitted to 2 or more sub-fields.
I'd like to put these sub-fields in new fields if they exists (basically I need to loop over the array)

How can I achieve it?

Example
Input: cron_id => "1_2_3"
output:
cron_l1 => 1
cron_l2 => 2
cron_l3 => 3
cron_l4 => "" (EMPTY)

Logstash Code:

mutate {
split => { "cron_id" => "_" }
add_field => {
"cron_l1" => "%{[cron_id][0]}"
"cron_l2" => "%{[cron_id][1]}"
"cron_l3" => "%{[cron_id][2]}"
"cron_l4" => "%{[cron_id][3]}"
}
}
if [message] =~ "^#" { drop{} }
}


(system) #2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.