Only String and Array types are splittable. field:[field][Name] is of type = Hash

Elastic Stack Logstash
1

Hello,

I just upgraded from LS 2.4 to 5.1.2 and i am having an issue with splitting values using the "split" filter. This exact configuration works in 2.4 without any issue but i am unable to get past the error in 5.1.2. Info below:

Data string: This has been broken out for readability. If the raw string is needed i have placed it at the bottom.
{"businessTransactions":{"occurrences":[{
"convertedBy":[]
"responseTime":8828.0
"values":[0.5]
"execTime":10994.09271658212
"clientErrors":0
"failed":false
"purePathId":"PT=306870;PA=865520890;PS=-663098133"
"clientTime":7929.140161869714
"url":"https://test.com.com"
"processingTime":5605
"networkTime":12.827512862494451
"duration":8828.0
"visitId":234294
"cpuTime":88.64864340622293
"dnsTime":0
"connectTime":0
"documentRequestTime":1
"documentResponseTime":1
"startTime":1485796352354
"serverTime":886.0323252677917
"dimensions":["tolerating"
"10.0.0.0"
"Desktop Browser"
"Windows"
"IE"]
"actionName":"load"}
{"convertedBy":[]
"responseTime":570.0
"values":[1.0]
"execTime":1209.8055751509964
"clientErrors":0
"failed":false
"purePathId":"PT=306871;PA=765838904;PS=-663098133"
"clientTime":281.36721664000714
"url":"https://test.com.com"
"networkTime":1.1624016232374834
"duration":570.0
"visitId":234294
"cpuTime":29.263739234767854
"startTime":1485796365718
"serverTime":287.47038173675537
"dimensions":["satisfied"
"10.0.0.0"
"Desktop Browser"
"Windows"
"IE"]
"actionName":"keypress on "searchBox""}
{"convertedBy":[]
"responseTime":5107.0
"values":[0.5]
"execTime":11648.502552277409
"clientErrors":0
"failed":false
"purePathId":"PT=306884;PA=-1990575953;PS=-663098133"
"clientTime":3574.5189283634018
"url":"https://test.com.com"
"networkTime":21.251010820786956
"duration":5107.0
"visitId":234294
"cpuTime":491.311846148298
"startTime":1485796374089
"serverTime":1511.2300608158112
"dimensions":["tolerating"
"10.0.0.0"
"Desktop Browser"
"Windows"
"IE"]
"actionName":"click on "Continue""}]
"application":"Client Center"
"dimensionNames":["Apdex performance zone for User Actions"
"Visits - IP Address"
"Client Type of Visits"
"Operating System of Visits"
"Client Family of Visits"]
"systemProfile":"RJ"
"name":"EXPORT_User Actions"
"measureNames":["Apdex of User Actions"]
"type":1}
"@timestamp":"2017-01-30T17:13:29.726Z"
"@version":"1"
"serverName":"dtServer.com.com"
"tags":["splitted_bts"]}

The config setting:
split {
field => "[businessTransactions][occurrences]"
}

The error:
Only String and Array types are splittable. field:[businessTransactions][occurrences] is of type = Hash

2

Full config:
input {

# 1st pass listener: interpreter for Dynatrace's protobuf message. input from dtamx01aplqa
http {
	threads => 8
	port => 8080
	codec => protobuf {
			class_name => "Export::Bt::BusinessTransactions"
			include_path => ['/app/etc/logstash/conf/dt_bt_export-6.3.5.rb']
			}#end codec
	}
# 2nd pass listener: read split messages for transforming/enhancing
http {
	threads => 8
	port => 8081
	codec => "json"
	tags => "stage2"
}

} #end input

filter {
# Stage 1
# we don't need host and headers
mutate {
remove_field => [ "headers", "host" ]
}

# check if this is a batch message from dynatrace containing multiple businesstransactions
# if yes split by BT and add a tag so we can identify it in the next pass
if ("splitted_bts" not in [tags]) {
	json {
    		source => "message"
	}
	split {
    		field => "businessTransactions"
    		add_tag => ["splitted_bts"]
	}
}

# if message has been already split by BTs, split again by every occurence of the BT
#if ( "splitted_bts" in [tags] and [businessTransactions][occurrences]) {
split {
    		field => "[businessTransactions][occurrences]"
	}
}

# Stage 2: this is the stage where every BT and every BT occurence has been split already and has been looped back into logstash
# now it's time for processing the single event. The first IF statement will check that a responseTime has been given, if it has not then the event is ignored.

}#end filter

output {
#if businesstransactions field exists we are in pass 1, have splitted and loop it back for further processing
#if [businessTransactions] {
# http {
# http_method => "post"
# url => "http://stash01aplqa.rjf.com:8081"
# }#end http
file {
path => "/var/log/logstash/dynatraceQA-Pre-Filter-TEST%{+YYYY-MM-dd}.txt"
}#end file

	#}#end if
	
	
		# second pass, processing and enhancing has been done, write out
	#else if ([businesstransaction] != "%{[businessTransactions][name]}")  {
	#	redis {
	#	 host => "10.97.0.150"
	#	 port => 6379
	#	 data_type => "list"
	#	 key => "logstash:redis"
	#	 codec => "rubydebug"
	#	}#end redis
		
		
	#}#end else

}#end output

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.