Logstash Mutate Arrays

Elastic Stack Logstash
1

Hello,

I have a simple question on arrays coming into Logstash.
Lets say I have this example:
Field Value
data.root [true, false]

This is expected behavior.

What I want to do:
Copy the first value of data root to a new field, how would I do it?
I tried to do mutate filter:

mutate {
        copy => { "[data][root][0]" => "[data][first]"}
      }

But it's not working, I assume I am not identifying it correctly?

2

I figured it out!
The issue was the field name was not identified correctly.

Based on my data structure, the array was parsed from data.

data {
   [0] { "root": "true"}
   [1] { "root": "false"}
}

So it worked by:
[data][0][root]

1 Like