Hi Logstash Community,
I am trying to break up a single input with multiple fields into multiple output documents in elasticsearch with a subsection of these fields contained, all using the same set of field names.
Background:
I am using the SNMP input plugin in logstash to monitor the health of a F5 Load Balancer (not important).
I am "walking" on an OID in the tree which holds an unknown number of "groups" of objects in it.
Each "group" has a number of values (below example is 3) which will are separated by a starting number and then a sequence of trailing numbers denoting the object.
Example Output at Present:
1.12.84 = "Name 1"
2.12.84 = 1
3.12.84 = "String 1"
1.13.47 = "Name 2"
2.13.47 = 2
3.13.47 = "String 2"
1.17.67. = "Name 3"
2.17.67 = 2
3.17.67 = "String 3"
.etc
Desired Output:
I would like to split up this single input into a number of outputs with the same field names based on each "group" of inputs (i.e. set of numbers following the initial 1./2. or 3.):
i.e.
document 1:
{
title = "Name 1"
value = 1
status = "String 1"
}
document 2:
{
title = "Name 2"
value = 2
status = "String 2"
}
document 3:
{
title = "Name 3"
value = 3
status = "String 3"
}
document ...
Does anyone know how one would:
- Split a single input into multiple output documents in the same index,
- Programmatically break up a group of fields and rename them for each output document.
All help greatly appreciated,
S