Hi
Magnusbaeck
The second code snippet worked and the first one did not produce any compile error but during run time logstash stalled. Now coming back to the event generated by the code snippet, the JSON looks like the following-
{
"_index": "logstash-xml-16.06.2017",
"_type": "logs",
........................
"_source": {
"Software Application 0": [
"Windows Genuine Advantage Validation Tool (KB892130)",
"Windows Genuine Advantage Validation Tool (KB892130)",
......................................................
],
"Software Application 1": [
"Intel(R) PRO Network Connections 11.2.0.69",
"Intel(R) PRO Network Connections 11.2.0.69",
"Intel(R) PRO Network Connections 11.2.0.69",
.......................................................
],
So basically i am still getting a single event in the kibana. To make it multiple event i have used metricize plugin and it did generated event for each 'software application' as i can see in the output of ruby debug but in kibana i get only one count (bar) for 'software application 0'.
Is not it possible to get multiple event/count/bar for the above JSON ( 'software application') ? Like for 5 'Software Aplication' tag there are 5 event/count/bar in kibana.
The JSON file is here
Regards