I have created the following aggregation in logstach. The data is not aggregated and is displayed next to the parent columns whereas they are supposed to be displayed in the nested columns:
Here is the mapping before running the logstach:
PUT s_c_nss
{
"mappings": {
"doc": {
"properties": {
"assigns": {
"type": "nested"
},
"others": {
"type": "nested"
}
}
}
}
}
Here is the filter in logstach:
filter {
aggregate {
task_id => "%{MyID}"
code => "
map['abc'] = event.get('abc')
map['cate'] = event.get('cate')
map['operator'] = event.get('operator')
map['assigns_list'] ||= []
map['assigns'] ||= []
if (event.get('assigns_ID') != nil)
if !( map['assigns_list'].include? event.get('assigns_ID') )
map['assigns_list'] << event.get('assigns_ID')
map['assigns'] << {
'assigns.id' => event.get('assigns_ID'),
'assigns.abr' => event.get('abr'),
}
end
end
event.cancel()
"
push_previous_map_as_event => true
timeout => 5
}
mutate {
remove_field => ["assigns_list"]
}
}
--- The result shows the 'assigns.id' and 'assigns.abr' next to 'abc' and 'cate' columns and not nested under "assigns'.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.