JSON Array using Logstash

[iti]

You need to understand how logstash event works.
Every event goes through filter/output. Aggregate filter does not filter out events. At output, you need to use if statement to discard none aggregated event. Otherwise last event stands.

See my example at

How to use jdbc to import data into nested objects?

assuming you have a mapping like: "mappings": { "atype": { "properties": { "@timestamp": { "type": "date" }, "@version": { "type": "text", "fields": { "keyword": { "type": "keyword", "ignore_above": 256 } } }, "id": { "type": "text", "fields": { "keyword": { "type": "keyword", "ignore_above": 256 } } }, "nestedpath": { "type": "nested", "properties": { "nested_field": { "type": "text", "fields": { "keyword": { "type": "keyword", "ignore_above": 256 } } } } …