I want to move all my fields to a specified subfield. However, I don't know all the field names. Alternatively if there is a way for grok filter to set the target field or similar? I found an old post that did this, which crashed my logstash (v7.6) ruby { code => " event['…

For future reference, this was what I was looking for: ruby { code => ' event.to_hash.each { |k, v| event.set("[field][" . k . "]" , v) } ' } But what was even better, is that I found out that the new grok-filter version 4.3.0 does in…

Discuss the Elastic Stack

Move all fields to a subfield?

Elastic Stack Logstash

Badger March 29, 2020, 3:31pm 2

Referring to the event as a hash was disabled years ago, you need to use the event API, like this.

Topic		Replies	Views
How to nest all fields in an event under a new field in logstash? Logstash	2	753	November 26, 2019
Logstash move subfield to top field Logstash	7	732	September 7, 2020
How to iterate over all fields with new Event API Logstash	2	2509	January 17, 2018
Ruby filter loop through fields in logstash 5? Logstash	3	3246	February 17, 2017
How to remove subfield using ruby Logstash	5	5659	January 2, 2017

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Move all fields to a subfield?

Related topics