Logstash mutate filter can change single field into multi_fields?

Elastic Stack Logstash
1

My logstash conf is like this.

input {
  jdbc {
    jdbc_driver_library => "/usr/local/pgsql/share/java/postgresql-9.4.1212.jar"
    jdbc_driver_class => "org.postgresql.Driver"
    jdbc_connection_string => "jdbc:postgresql://abcdata.co.jp:5432/abc"
    jdbc_user => "user"
    jdbc_password => "pass"
    statement => "SELECT id , item_info, update_date from items"
  }
}
output {
  elasticsearch {
    hosts => ["192.168.33.10"]
    index => "test_multi_field_index"
    document_type => "items"
    document_id   => "%{id}"
  }
}

Can I put item_info column into multi_field by using mutate filter like this?

filter{
mutate {
rename => { "item_info" =>  "item_info" : {"full_match" , "partial_match"} }

ES ver 2.4.2
logstash ver 2.4

2

No, I think you need to use a ruby filter for this.

3

Ok. Thanks.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.