... using ingest processors. Basically, I have an array of User Principal Names and want to extend the field with just the sAMAccountNames also.
I've tried
Just Grok: does not work on Array fields
Just Split: does not work on Array fields
Foreach + Grok: Target expression %{DATA:_ingest.temp_user_name}@%{GREEDYDATA:_ingest.temp_user_domain} always overrides the _ingest.temp_user_name and does not append - so at the end of the foreach, only one value is in _ingest.temp_user_name.
Foreach + Split without target_field (in-place): yields [["user1","domain"],["user2","anotherdomain"]] - but also overrides the original data. plus I wouldn't know how to collect this into just ["user1", "user2"]
Foreach + Split with target_field: Will also override the target_field and only keep the value of the last iteration.
Anyone got more Ideas on how to solve this? do i have to go with script processors?
awesome, thanks for already providing the script solution.
I've added a check to make sure the operation only runs on array members that contain an "@" sign.
ctx.related.tmp_user = new ArrayList();
for (int i = 0; i < ctx.related.user.size(); i++) {
def email = ctx.related.user[i]; // email/upn
ctx.related.tmp_user.add(email);
if (email.contains("@")) {
def username = email.splitOnToken('@')[0];
ctx.related.tmp_user.add(username);
}
}
ctx.related.user = ctx.related.tmp_user;
ctx.related.remove('tmp_user');
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.