Logstash and AWS Cloudtrail

[stephenb (Stephen Brown)]

Perhaps take a look at this from our resident logstash expert

A JSON array consists of objects - how to deal with?

Firstly, I do not understand your concern with indexing 200 separate documents. That said, there are a couple of approaches you could take. One would be to iterate over the array in a ruby filter, like this ruby { code => ' oldData = event.get("data") newData = [] oldData.each { |x| if x.include? "iso.org.dod.internet.experimental.94.1.8.1.3" x["name"] = x["iso.org.dod.internet.experimental.94.1.8.1.3"] …

And here is split

Split filter plugin | Logstash Reference [8.11] | Elastic