I want to move all my fields to a specified subfield. However, I don't know all the field names. Alternatively if there is a way for grok filter to set the target field or similar? I found an old post that did this, which crashed my logstash (v7.6) ruby { code => " event['…

For future reference, this was what I was looking for: ruby { code => ' event.to_hash.each { |k, v| event.set("[field][" . k . "]" , v) } ' } But what was even better, is that I found out that the new grok-filter version 4.3.0 does in…

Discuss the Elastic Stack

Move all fields to a subfield?

Elastic Stack Logstash

Badger March 29, 2020, 3:31pm 2

Referring to the event as a hash was disabled years ago, you need to use the event API, like this.

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.