Logstash Mutate Arrays

Elastic Stack Logstash
2

I figured it out!
The issue was the field name was not identified correctly.

Based on my data structure, the array was parsed from data.

data {
   [0] { "root": "true"}
   [1] { "root": "false"}
}

So it worked by:
[data][0][root]

1 Like