mPanasiewicz
(Maciej Panasiewicz)
November 6, 2017, 11:51am
1
Hello,
I've got sth like:
[
{"aaa": "bbb"},
{"ccc": "ddd"},
{"eee": "fff"}
]
I've tried split input plugin but I think it would not work becouse I need parent key of the array. In this case there is no key because array is top instance without key. I read this:
I have a log file that's an array of objects that looks something like this:
[
{
"cate1": "data1a",
"cate2": "data2a"
},
{
"cate1": "data1b",
"cate2": "data2b"
}
]
and I need each object in the array to be a separate entry in Elasticsearch and each "cate" to be a field. How would I go about configuring Logstash to do this?
but there is no answer of my problem.
Thank you for your help.
paz
November 6, 2017, 2:23pm
2
What exactly is your goal? Do you need each element as a separate event or as a top-level field in the same event?
Also, what is the actual input?
mPanasiewicz
(Maciej Panasiewicz)
November 6, 2017, 2:39pm
3
My input is sth like this:
[
{"aaa": "bbb"},
{"ccc": "ddd"},
{"eee": "fff"}
]
I would like each object separate as a document.
Document:
{"aaa": "bbb"}
Document:
{"ccc": "ddd"}
Document:
{"eee": "fff"}
paz
November 6, 2017, 2:49pm
4
Then defining a
codec => "json"
in your input should be sufficient enough for this (unless it's multiline, in which case it becomes a bit trickier).
mPanasiewicz
(Maciej Panasiewicz)
November 6, 2017, 3:34pm
5
@Paris Mermigkas It's working!!! Thank you very much. I thought that I need to do this by filter but codec works great! Thank you!!!
Topic can be closed
system
(system)
Closed
December 4, 2017, 3:34pm
6
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.