This performs the contents of the code block (surrounded by {}) for each member of the array [ "ForwardedIpAddress", "IpAddress" ], substituting the value of the member for the field variable.
Get the value of the field with the name of the field variable (i.e., first [ForwardedIpAddress], then in the next iteration [IpAddress]) and assign it to f
f = event.get(field)
Verify that the field exists. If it does not then event.get returns nil and the if will test false
if f
Split the field into an array using a comma as the separator
f = f.split(",")
For each member of that array
f.each_index { |x|
Set a field on the event with the name ForwardedIpAddress0 equal to the first member of the array derived from ForwardedIpAddress etc. This is string interpolation.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.