How to parse values as key value not array

Elastic Stack Logstash
1

Hi there. I am trying parse a text file containing values below.

15, 3241
16, 800
17, 1

Below if my logstash configuration. When I checked in Kibana , I have the field document displayed as a array.
"hcount": [ 800 ]

My intention is to have the field as a key value not a array. Could you help ?
"count": 800

200-filter.conf

filter {
if [log][file][path] =~"hourly"{
  grok { 
    match => "message" => "%{NUMBER:hour},%{NUMBER:count}" }
    add_field => { "hcount" => "%{count}" }
    add_tag => ["sit"]
 }
  mutate {
     convert => { "hcount" => "integer"}
}
}
}
2

Welcome to the community!

Most likely you have to recreate dataview in Kibana and use another index name, because during testing you send wrong data which has been recognized as array.
This looks like csv, no need for grok, use csv plugin

filter {
  grok { match => {"message" => "%{NUMBER:hour}, %{NUMBER:count:int}"  }
      add_field => { "hcount" => "%{count}" }
      add_tag => ["sit"]
  }
  mutate { convert => { "hcount" => "integer"} }

# another approach
  csv{
     columns => ["hour1","count1"]
     convert => {  "count1" => "integer" }
	}

}

Result:

{
         "hour1" => "15",
        "count1" => 3241,
          "hour" => "15",
         "count" => 3241,
        "hcount" => 3241,
          "tags" => [
        [0] "sit"
    ]
}
3

Thanks for the input.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.