Mutate - Split - datatype remains string

Hi,

I have a field with comma separated city names. I have applied simple split as below.

filter {
mutate { split => { "city" => ',' } }
}

But, in index mapping, the data type displayed is string. Can someone guide on this please.

Thanks,

Varsh..

Hi,

if you could post an example that would be helpful. The City is always a string, a string is just an char array.

What kind of output where you expecting?

Hi,

I think it was my mistake! The issue is solved. It is storing as array only.
BTW, do you know how can I get a value from an array matching a key? I mean, I am storing some values in index, for which I have ids, say department id. I have a list/master of department, where the id->department name is available. I need to store the department name in the index along with department id.

I tried a few filters like, translate and a couple of others, nothing works man.. Kind of stuck up on this since a few hours now !!

Your help will be great !

Thanks,

Varsh..

You should be able to do that with the translate filter in logstash

https://www.elastic.co/guide/en/logstash/current/plugins-filters-translate.html#plugins-filters-translate-dictionary

Let's say you have the following key values.

103445: "Department 1"
10230: "Departement 2"

your translate should look like this

translate{
  field => "department_id"
  destination => "departement_name"
  dictionary_path => "departements.yml"
}