Logstash add subfield to elasticsearch index

Elastic Stack Logstash
1

Hi, i want to add a sub field called prefix to a text field called title using a logstash filter plugin. how do i go about this? i need this because the sub fields are required in app search. here is my logstash config so far

    input {
      jdbc {
        jdbc_driver_library => "/usr/share/logstash/logstash-core/lib/jars/postgresql-jdbc.jar"
        jdbc_driver_class => "org.postgresql.Driver"
        jdbc_connection_string =>"jdbc:postgresql://${DB_HOST}:${DB_PORT}/${DB_NAME}"
        jdbc_user => "${DB_USER}"
        jdbc_password => "${DB_PASSWORD}"
        schedule => "*/2 * * * *"
        statement => "SELECT * from search"
      }
    }

   filter {
      mutate {
        rename => {"title" => "[title]"}
        add_field => {"[title][prefix]" => "${[title]}"}
      }
    }

    output {
    # used to output the values in the terminal (DEBUGGING)
    # once everything is working, comment out this line
    stdout { codec => "json" }
    # used to output the values into elasticsearch
    elasticsearch {
         hosts => ["${ELASTICSEARCH_HOSTS}"]
         index => "search"
         document_id => "%{id}"
         user => "${ELASTICSEARCH_USERNAME}"
         password => "${ELASTICSEARCH_PASSWORD}"
         ssl => true
         cacert => "/usr/share/logstash/certs/ca.crt"
         doc_as_upsert => true # upserts documents (e.g. if the document does not exist, creates a new record)
     }
    }

basically i want the title field to have a subfield called prefix (title.prefix)

2

That is a no-op. Can you show, using JSON, the before and after structures you want?

3

i want to add these subfields to my text field called title

specifically the field.prefix subfield

4

You could try that. I would expect that to result in a mapping exception, but then I didn't know elasticsearch could support those subfields.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.