I have not tested it, but you could try something like
ruby { code => 'event.set("[@metadata][body]", event.to_hash)' }
then use
body => "%{[@metadata][body]}"
You might also want to set the body_format option.
I have not tested it, but you could try something like
ruby { code => 'event.set("[@metadata][body]", event.to_hash)' }
then use
body => "%{[@metadata][body]}"
You might also want to set the body_format option.
© 2020. All Rights Reserved - Elasticsearch
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.