Inges pipeline - KV processor not working with foreach

Elastic Stack Elasticsearch
1

hello guys! I'm using an ingest pipeline. I'm using the foreach processor and inside of it the kv processor but it's not really working.. Having the following array (made after using the split processor)

"detail" : [
            "Querying host performance metrics, interval=300, host=dal13esx041fms1.prdcloud.fms.ibmcloud.com, cores=24, elapsed time=1.121 seconds",
            "Querying host performance metrics, interval=1800, host=dal13esx041fms1.prdcloud.fms.ibmcloud.com, cores=24, elapsed time=0.32 seconds",
            "Querying host performance metrics, interval=300, host=dal13esx021fms1.prdcloud.fms.ibmcloud.com, cores=24, elapsed time=1.104 seconds",
            "Querying host performance metrics, interval=1800, host=dal13esx021fms1.prdcloud.fms.ibmcloud.com, cores=24, elapsed time=0.288 seconds",
            "Querying host performance metrics, interval=300, host=dal13esx011fms1.prdcloud.fms.ibmcloud.com, cores=24, elapsed time=1.058 seconds",
            "Querying host performance metrics, interval=1800, host=dal13esx011fms1.prdcloud.fms.ibmcloud.com, cores=24, elapsed time=0.323 seconds",
            "Querying host performance metrics, interval=300, host=dal13esx031fms1.prdcloud.fms.ibmcloud.com, cores=24, elapsed time=1.039 seconds",
            "Querying host performance metrics, interval=1800, host=dal13esx031fms1.prdcloud.fms.ibmcloud.com, cores=24, elapsed time=0.296 seconds",
            "Querying host performance metrics, interval=300, host=dal13esx051fms1.prdcloud.fms.ibmcloud.com, cores=24, elapsed time=1.309 seconds",
            "Querying host performance metrics, interval=1800, host=dal13esx051fms1.prdcloud.fms.ibmcloud.com, cores=24, elapsed time=0.461 seconds"
          ],

Kv is not really collecting the details, it's doing nothing

        "foreach" : {
          "field" : "detail",
          "processor": {
            "kv": {
              "field": "_ingest._value",
              "field_split": ", ",
              "value_split": "=",
              "ignore_failure": true
            }
          }
        }
      }

Any help will be welcome!

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.