Yes, but what I would like to have is a new filter named for example alarmLevel and inside there is the level : warning, error, info...
the desired output is
ruby {
code => '
a = []
event.get("alarm").each { |k, v|
h = Hash.new
h["alarmLevel"] = k
h["alarmValue"] = v
a << h
}
event.remove("alarm")
event.set("alarm", a)
'
}
split { field => "alarm" }
If you need to then move the contents of alarm to the root level look at this.
If we added "[ ]" at the beginning and the end of the value of alarmMetadata with logstash, would it create the field "alarmMetadata" ? So the dictionary turns into a list..
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.