How do I feed nested data like the one below using Logstash extracted from a CSV file?
I checked out the below posts but couldnt find a solution built into logstash that helps convert a flat row from a database or an excel sheet into nested JSON that can be fed into elasticsearch.
Hello,
I would like to ask a question regarding accessing nested fields in logstash.
There is "processes" object in my JSON which has nested field "Name". I would like to extract the field value from the nested object to separate field.
This is working:
mutate{
add_field => { "Name" => "%{processes[Name]}" }
}
Then suppose that there is also "columns" object in my JSON, which contains names of fields of the "processes" object:
"columns":["Offset(V)","Name","PID","PPID","Thds","Hnds","Ses…
https://discuss.elastic.co/search?q=import%20into%20nested%20fields
Hi everybody,
I have multiple tables in my database which I would like to import into Elasticsearch using a single document type. One of the tables has a one-to-many relation to another table.
I will use the example as provided in the guide to explain the problem, because my problem is similar (https://www.elastic.co/guide/en/elasticsearch/guide/current/nested-objects.html ). So we have blogposts (in one table) and each blogpost can have multiple comments (in another table, linked with a one-to…
“partterm” : {
“type” : “nested”,
“properties” : {
“amoe” : {
“type” : “text”,
“index” : false
},
“buyersguide” : {
“properties” : {
“P” : {
“properties” : {
“I” : {
“type” : “text”,
“fields” : {
“keyword” : {
“type” : “keyword”,
“ignore_above” : 256
}
}
},
“M” : {
“properties” : {
“FY” : {
“type” : “text”,
“fields” : {
“keyword” : {
“type” : “keyword”,
“ignore_above” : 256
}
}
},
“I” : {
“type” : “text”,
“fields” : {
“keyword” : {
“type” : “keyword”,
“ignore_above” : 256
}
}
},
“MO” : {
“properties” : {
“E” : {
“properties” : {
“I” : {
“type” : “text”,
“fields” : {
“keyword” : {
“type” : “keyword”,
“ignore_above” : 256
}
}
},
system
(system)
Closed
September 22, 2017, 6:59pm
2
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.