Parse Array and Send to Elastic Filter

Elastic Stack Logstash
1

Hello,

I have an array of strings which I'd like to send nested object to an Elasticsearch filter to obtain additional data in a separately stored index. I've been searching for an approach to this but I cannot seem to find an example. I'm comfortable with creating the Elasticsearch filter, but I'm trying to determine a way to pull out each value from the array to send to the filter. I've looked at a Ruby filter, but I don't see how I can create the ES filter within that block of code.

Here is my sample data...


      "categories": [
        "Red Hat",
        "Red Hat Enterprise Linux",
        "Remote Execution"
     ]

Each category individually gets sent to the ES filter.

Thank you for any guidance you can offer.

2

Perhaps use a split filter, so that instead of an event with an array you have three events in which [categories] is a string. It is really not clear what you want to do.

If there is a limit to the number of categories then you might also be able to do

if [categories][0] { elasticsearch { query => "someField: %{[categories][0]}" ... } }
if [categories][1] { elasticsearch { query => "someField: %{[categories][1]}" ... } }
if [categories][2] { elasticsearch { query => "someField: %{[categories][2]}" ... } }
if [categories][3] { elasticsearch { query => "someField: %{[categories][3]}" ... } }
3

This is exactly what I wanted. I wasn't sure if there were a better method to parse through the array vs having to define each array position. There should only be about 5 or 6 categories.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.