How to split array field in json and send it as separate event

Elastic Stack Logstash
1

Please find the debug o/p , We want each logEvents as separate event in kibana, since logEvents will be huge in count and it takes time to load in kibana

{
"logEvents" => [
[ 0] {
"message" =>
"id" =>
"timestamp" =>
"extractedFields" =>
"dstport" =>
"bytes" =>
"srcport" =>
"version" =>
"log_status" =>
"action" =>
"packets" =>
"protocol" =>
"end" =>
"account_id" =>
"interface_id" =>
"start" =>
"srcadent" =>
"dstadent" =>
}
},
[ 1] {
"message" =>
"id" =>
"timestamp" =>
"extractedFields" =>
"dstport" =>
"bytes" =>
"srcport" =>
"version" =>
"log_status" =>
"action" =>
"packets" =>
"protocol" =>
"end" =>
"account_id" =>
"interface_id" =>
"start" =>
"srcadent" =>
"dstadent" =>
}
},
"messageType" => "",
"@version" => "1",
"@timestamp" => 2019-09-05T07:42:13.612Z,
"subscriptionFilters" => [
[0] "vpc"
],
"logGroup" => "",
"s3Path" => "",
"owner" => "",
"logStream" => ""
"type" => ""
}

2

Use a split filter.

3

It didn't work. No events were shipped to ES , when we use "split"

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.