Hello,
I would like to split a field value into an array of values. Field type is keyword and I would like to separate these values, so we can filter each value separately (e.g. "app1").
example:
applname: app1, app2, app3
expected result:
applname: ["app1","app2","app3"]
I tried to use split filter:
mutate {
split => { "applname" => ", " }
}
But the result was:
"applname": ["app1,app2,app3"]
Is there a better way how to achieve the expected result?
Thanks!