Repeated keys converted to array


I am getting repeated keys in my log data.
In such a case i want to just pick one key-value pair for my output, but logstash creates a array of values.

Is there a way to pick just one key-value when there are duplicate keys?

Mihir Ray

It's not very clear what you're asking. Please provide an example of what you currently have and what you'd like to get instead.

Suppose my data is "a=1&c=1&a=2", if i use the kv filter, i will get:


Instead of creating an array for "a", i want it to be a regular string(either 1 or 2), any random value is fine.

See allow_duplicate_values. When in doubt, consult the documentation and look at what's available.

allow_duplicate_values works when the values are same for duplicate keys.
In my case the values are different and i want to pick one.

Oh, right. In that case you'll have to use a ruby filter to iterate over fields and turn array fields into scalar values.