Only String and Array types are splittable. field:[field][Name] is of type = Hash

(Graham D) #1


I just upgraded from LS 2.4 to 5.1.2 and i am having an issue with splitting values using the "split" filter. This exact configuration works in 2.4 without any issue but i am unable to get past the error in 5.1.2. Info below:

Data string: This has been broken out for readability. If the raw string is needed i have placed it at the bottom.
"Desktop Browser"
"Desktop Browser"
"actionName":"keypress on "searchBox""}
"Desktop Browser"
"actionName":"click on "Continue""}]
"application":"Client Center"
"dimensionNames":["Apdex performance zone for User Actions"
"Visits - IP Address"
"Client Type of Visits"
"Operating System of Visits"
"Client Family of Visits"]
"name":"EXPORT_User Actions"
"measureNames":["Apdex of User Actions"]

The config setting:
split {
field => "[businessTransactions][occurrences]"

The error:
Only String and Array types are splittable. field:[businessTransactions][occurrences] is of type = Hash

(Graham D) #2

Full config:
input {

# 1st pass listener: interpreter for Dynatrace's protobuf message. input from dtamx01aplqa
http {
	threads => 8
	port => 8080
	codec => protobuf {
			class_name => "Export::Bt::BusinessTransactions"
			include_path => ['/app/etc/logstash/conf/dt_bt_export-6.3.5.rb']
			}#end codec
# 2nd pass listener: read split messages for transforming/enhancing
http {
	threads => 8
	port => 8081
	codec => "json"
	tags => "stage2"

} #end input

filter {
# Stage 1
# we don't need host and headers
mutate {
remove_field => [ "headers", "host" ]

# check if this is a batch message from dynatrace containing multiple businesstransactions
# if yes split by BT and add a tag so we can identify it in the next pass
if ("splitted_bts" not in [tags]) {
	json {
    		source => "message"
	split {
    		field => "businessTransactions"
    		add_tag => ["splitted_bts"]

# if message has been already split by BTs, split again by every occurence of the BT
#if ( "splitted_bts" in [tags] and [businessTransactions][occurrences]) {
split {
    		field => "[businessTransactions][occurrences]"

# Stage 2: this is the stage where every BT and every BT occurence has been split already and has been looped back into logstash
# now it's time for processing the single event. The first IF statement will check that a responseTime has been given, if it has not then the event is ignored.

}#end filter

output {
#if businesstransactions field exists we are in pass 1, have splitted and loop it back for further processing
#if [businessTransactions] {
# http {
# http_method => "post"
# url => ""
# }#end http
file {
path => "/var/log/logstash/dynatraceQA-Pre-Filter-TEST%{+YYYY-MM-dd}.txt"
}#end file

	#}#end if
		# second pass, processing and enhancing has been done, write out
	#else if ([businesstransaction] != "%{[businessTransactions][name]}")  {
	#	redis {
	#	 host => ""
	#	 port => 6379
	#	 data_type => "list"
	#	 key => "logstash:redis"
	#	 codec => "rubydebug"
	#	}#end redis
	#}#end else

}#end output

(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.