How to split the records on data with only value and without key


(Ritesh) #1

Hi All

Currently, i am getting data in the below format

 "rows": [
        [
            "New Visitor",
            "(not set)",
            "(direct)",
            "(none)",
            "desktop",
            "123456",
            "Direct",
            "2",
            "2",
            "0",
            "4",
            "156.0",
            "0",
            "0.0",
            "0"
        ],
        [
            "New Visitor",
            "(not set)",
            "(direct)",
            "(none)",
            "desktop",
            "25677001",
            "Direct",
            "1",
            "0",
            "0",
            "3",
            "76.0",
            "0",
            "0.0",
            "0"
        ],

How can i split the key and define the event for each value. Upfront i know the event name for each value.
Currently when i index,i see only 1 record.
I was planning to use split event, since it does not have any key,how we can split such data?


(Ritesh) #2

Hi, I used split at rows, now i am able to get multiple records. But the problem how i assign them to individual events/columns

split {field => "[rows]"}

For example :
"Visitor Type" Column will hold value "New Visitor"
"Page Type" Column will hold value "(not set)"
"Instance" column will hold value "(direct)" and so on....

How can i assign column to each comma seperated values?

 "rows": [
      "New Visitor",
      "(not set)",
      "(direct)",
      "(none)",
      "desktop",
      "201801030000",
      "Direct",
      "2",
      "2",
      "0",
      "4",
      "156.0",
      "0",
      "0.0",
      "0"
    ],

(Magnus B├Ąck) #3
mutate {
  add_field => {
    "Visitor Type" => "%{rows[0]}"
  }
}

(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.