Is there an efficient approach to solve this ? I believe this could be solved by ruby filter plugin after going through a few links like : Indent any json file nested fields and make it flat. Could this also be solved in any other way other than writing a ruby script ?
Hmm. Thinking about it, this would be much cleaner if done as a ruby script file, since that can return an array of events, so the split would not be needed. If you create a file called invertUnits.rb containing
def register(params)
@field = params['field']
end
def filter(event)
newEvents = []
o = event.get(@field)
if !o
newEvents << event
else
(0..1).each { |n|
e = LogStash::Event.new
o.each { |k, v|
e.set(k, v[n])
}
[ "@timestamp", "@version", "host", "sequence" ].each { |k|
v = event.get(k)
if v
e.set(k, v)
end
}
newEvents << e
}
end
newEvents
end
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.