wanted to transfer two json documents, one has hotel data and other one has destination data. destination object in hotel.json and code in destination.json are the common objects.
hotel.json
results :[ {code:1001,name:river side hotel,destination:526}
{code:1002,name:Fingara hotel,destination:526}
{code:1003,name:watesedge hotel,destination:512}
{code:1004,name:beach side hotel,destination:526}]
destination.json
results :[ {code:526,name:Colombo,country:LK}
{code:512,name:Landon,country:UK}
use translate pluging, but not working. transfer only hotel.json to elasticsearch
input {....}
filter{
json { source => "message" }
split { field => "results" }
mutate {
add_field => {
"hotelcode" => "%{[results][code]}"
"hotelname" => "%{[results][name]}"
"vendorcitycode" => "%{[results][destination]}"
}
translate {
destination => "[@metadata][destination_]"
dictionary_path => "/home/namalie/elk/hotelspro_v2/destination.json"
add_field => {"vendorcitycode" => "%{[results][code]}" }
field => "vendorcitycode" }
dissect { mapping => { "[@metadata][destination_]" => "%{[results][name]}" } }
}