Parent-child relation config in logstash

Hello, I'm a debutant on Elasticsearch, I have two table "operation" and "metric" on oracle and I will like the reassembled in Elasticsearch in use parent relation child for that is what I must create the parent index apart and do the same for the child or i create all same time. this is my file config. Thanks you.

input {
jdbc {
jdbc_driver_library => "C:\Users\projet.sar.GREPRV\Desktop\logstash-7.1.1\db\ojdbc7.jar"
jdbc_driver_class => "Java::oracle.jdbc.driver.OracleDriver"
jdbc_connection_string => "jdbc:oracle:thin:@//mrlin1.greprv.local:1521/mercuri"
jdbc_validate_connection => true
jdbc_user => "mercuri_c_valid"
jdbc_password => "mercuri"
statement => "SELECT operations., metriques., TO_NUMBER(metriques.METRIQUES_MESURE) as METRIQUES_MESURE_INT
from operations FULL OUTER JOIN metriques on metriques.METRIQUES_OPERATIONS_ID=operations.OPERATIONS_ID
WHERE OPERATIONS_TYPE = 'Traitement driver' and OPERATIONS_TYPE_PHASE = 'Relevé' and
OPERATIONS_TYPE_MOYEN_COMM = 'OPTO-COUPLEUR' and OPERATIONS_SEQUENCE = 'Relevé de maintenance'
and metriques.METRIQUES_MESURE is not null and METRIQUES_TYPE='temps_execution'"
}
}

filter {

aggregate {	
	task_id => "%{OPERATIONS_ID}"
	code => "
	map['parent'] ||= {} 
	map['OPERATIONS_ID'] = event.get('OPERATIONS_ID') 		
	map['OPERATIONS_NNI'] = event.get('OPERATIONS_NNI') 
    map['OPERATIONS_NOM_PC'] = event.get('OPERATIONS_NOM_PC') 		
	map['OPERATIONS_DATE_RECEPTION'] = event.get('OPERATIONS_DATE_RECEPTION') 
	map['OPERATIONS_TYPE'] = event.get('OPERATIONS_TYPE') 		
	map['OPERATIONS_MODE_AFFICHAGE'] = event.get('OPERATIONS_MODE_AFFICHAGE') 
	map['OPERATIONS_MODE_ENREGISTREMENT'] = event.get('OPERATIONS_MODE_ENREGISTREMENT') 		
	map['OPERATIONS_TYPE_PHASE'] = event.get('OPERATIONS_TYPE_PHASE') 
	
	map['OPERATIONS_ADS'] = event.get('OPERATIONS_ADS') 		
	map['OPERATIONS_TYPE_COMPTEUR'] = event.get('OPERATIONS_TYPE_COMPTEUR') 
    map['OPERATIONS_TYPE_CONTRAT'] = event.get('OPERATIONS_TYPE_CONTRAT') 		
	map['OPERATIONS_TYPE_MOYEN_COMM'] = event.get('OPERATIONS_TYPE_MOYEN_COMM') 
	map['OPERATIONS_SEQUENCE'] = event.get('OPERATIONS_SEQUENCE') 		
	map['OPERATIONS_STATUT'] = event.get('OPERATIONS_STATUT') 
	map['OPERATIONS_DATE_REALISATION'] = event.get('OPERATIONS_DATE_REALISATION') 		
	map['OPERATIONS_VERSION_PPLEMENT_BD'] = event.get('OPERATIONS_VERSION_PPLEMENT_BD') 
	
	map['OPERATIONS_VERSION_APPLICATION'] = event.get('OPERATIONS_VERSION_APPLICATION') 		
	map['OPERATIONS_COMMENTAIRE'] = event.get('OPERATIONS_COMMENTAIRE') 
	map['OPERATIONS_IDC_OU_ACTION'] = event.get('OPERATIONS_IDC_OU_ACTION') 		
	map['OPERATIONS_MODEM'] = event.get('OPERATIONS_MODEM') 
	
	
	map['parent']['child'] ||= []
	map['parent']['child'] << {'METRIQUES_ID' => event.get('METRIQUES_ID'),'METRIQUES_OPERATIONS_ID' => event.get('METRIQUES_OPERATIONS_ID'),
	'METRIQUES_SOUS_OPERATIONS_ID' => event.get('METRIQUES_SOUS_OPERATIONS_ID'),'METRIQUES_TYPE' => event.get('METRIQUES_TYPE'), 'METRIQUES_MESURE_INT' => event.get('METRIQUES_MESURE_INT'),
	'METRIQUES_COMMENTAIRE' => event.get('METRIQUES_COMMENTAIRE'), 'OPERATIONS_ID' => event.get('OPERATIONS_ID') }	
	event.cancel()
 "
	push_previous_map_as_event => true
	timeout => 5
	map_action =>create_or_update
} 

}

output {
elasticsearch {
hosts => ["localhost:9200"]
index => "logstash_metriques-%{+YYYY.MM.dd}"
document_type => "operations"
document_id => "%{operations_id}"
action => "create"
}
stdout { codec => rubydebug }
}

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.