Iterate entries in ctx.payload

Elastic Stack Elasticsearch
1

Hi,

I have the following entries in ctx.payload and the entries are by user id. The first entry is the timestamp and the 2nd entry is the number of times the user failed to login in that bucket.

mydomain\user1=[1559669100000 2, 1559669160000 2, 1559669237000 2, 1559669280000 2, 1559669294000 1, 1559669295000 1],mydomain\user2=[1559669100000 2, 1559669160000 2, 1559669237000 2, 1559669280000 2, 1559669294000 1, 1559669295000 1]

I need help with mapping them into individual fields.

Thanks in advance.

Thanks
Murali

2

Hi All,

I was able to figure it out :-). This is what I did.

"script": "return ['_doc':ctx.payload.entrySet().stream().flatMap(value -> value.getValue().stream().map(time_failedlogin -> ['@timestamp':time_failedlogin.substring(0,time_failedlogin.lastIndexOf(' ')), 'failed_logins':time_failedlogin.substring(time_failedlogin.lastIndexOf(' ')+1), 'alerttype': 'Login Failure', 'username':value.getKey()])).collect(Collectors.toList())];"

Thanks
Murali

1 Like
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.