Repeated keys converted to array

(Mihir Ray) #1


I am getting repeated keys in my log data.
In such a case i want to just pick one key-value pair for my output, but logstash creates a array of values.

Is there a way to pick just one key-value when there are duplicate keys?

Mihir Ray

(Magnus Bäck) #2

It's not very clear what you're asking. Please provide an example of what you currently have and what you'd like to get instead.

(Mihir Ray) #3

Suppose my data is "a=1&c=1&a=2", if i use the kv filter, i will get:


Instead of creating an array for "a", i want it to be a regular string(either 1 or 2), any random value is fine.

(Magnus Bäck) #4

See allow_duplicate_values. When in doubt, consult the documentation and look at what's available.

(Mihir Ray) #5

allow_duplicate_values works when the values are same for duplicate keys.
In my case the values are different and i want to pick one.

(Magnus Bäck) #6

Oh, right. In that case you'll have to use a ruby filter to iterate over fields and turn array fields into scalar values.

(system) #7