How to split array json into multiple fields

Elastic Stack Logstash
1

Hi All,

I have a array json which am getting from http end point

"summary": { "result": [ { "status": { "offlineCount": 0, "warningCount": 0, "onlineCount": 1 }, "store": { "code": "345", "name": "Groovy", "id": "8" } }, { "status": { "offlineCount": 1, "warningCount": 0, "onlineCount": 0 }, "store": { "code": "3435", "name": "Groovy Result", "id": "8" } } ] }

I need to split into multiple documents like below

"summary": {
  "result": [
    {
      "status": {
        "offlineCount": 0,
        "warningCount": 0,
        "onlineCount": 1
      },
      "store": {
        "code": "345",
        "name": "Groovy",
        "id": "8"
      }
    }
	]
}

"summary": {
"result": [
{
"status": {
"offlineCount": 1,
"warningCount": 0,
"onlineCount": 0
},
"store": {
"code": "3435",
"name": "Groovy Result",
"id": "8"
}
}
]
}

Could some one help me how can achieve this using logstash/ingestion pipelines

Thanks

2

Use a split filter

 split { field => "[summary][result]" }
3

Thank you for the response. I am getting below error in logstash

[2021-03-13T08:33:15,282][WARN ][logstash.filters.split ] Only String and Array types are splittable. field:[summary][result] is of type = NilClass

4

That is telling you that the [summary][result] field does not exist. You could avoid logging that by using

if [summary][result] { split { field => "[summary][result]" } }
5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.