Logstash Split input and save new event.original

Elastic Stack Logstash
1

Good Morning,

I am trying to split up some JSON logs that are collected from an Eventhub and i'm running into a few issues.

My logstash filter below works fine and splits the json based on a field called records, and then removes the records top level field.

	# Split results into individual events
	split {
		field => "records"
	}
	
	ruby {
		code => "
			event.get('records').each {|k, v|
			event.set(k, v)
			}
			event.remove('records')
		"
	}
	
	mutate {
		copy => {"[message]" => "[event][original]"} 
	}

The problem i have is now how do i place the true original log (i.e. split out without the records) into event.orginal?

Message still contains the full eventhub file, not my updated logs. Does anyone know how i now place this new formatted log into event.orginal so i can use it elsewhere?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.