My problem is specific as below.
the event message is:
{"a":[{"aa":"v1"},{"bb":"v2"}]}
how to add a field ,namely, "a_size" and its value is array a's length. so the output is like below:
{"a":[{"aa":"v1"},{"bb":"v2"}],"a_size":2 }
My problem is specific as below.
the event message is:
{"a":[{"aa":"v1"},{"bb":"v2"}]}
how to add a field ,namely, "a_size" and its value is array a's length. so the output is like below:
{"a":[{"aa":"v1"},{"bb":"v2"}],"a_size":2 }
filter {
ruby {
code => "event['a_size'] = event['a'].length"
}
}
(You should wrap the filter in a conditional so you don't attempt this if the a
field doesn't exist.)
© 2020. All Rights Reserved - Elasticsearch
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.