Logstash parse object

Elastic Stack Logstash
1

Hello,
I have in a field which I need to split thé next values

FieldA : "[{" FieldA1" :"A", "FieldA2" :"B"}{"FieldA1" :"C", "FieldA2" :"D"]}"

I wan't to split FieldA as two documents

{" FieldA1" :"A", "FieldA2" :"B"}
{" FieldA1" :"C", "FieldA2" :"D"}

Thank you.
Regards

2

You can use a split filter to divide an array into multiple events. You can move fields to the top level using this.

4

Thank for your response.
To use split, objects are comma separated

results: [
{ result ... },
{ result ... },
{ result ... },
...
]

I don't have this for my values

results: [
{ result ... }
{ result ... }
{ result ... }
...
]

5

If it is a string rather than an object you could scan for a regexp.

7

Thank,
But I have a big strings. So complex to write regex for this!

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.