Repeated keys converted to array

Elastic Stack Logstash
1

HI,

I am getting repeated keys in my log data.
In such a case i want to just pick one key-value pair for my output, but logstash creates a array of values.

Is there a way to pick just one key-value when there are duplicate keys?

Thanks,
Mihir Ray

2

It's not very clear what you're asking. Please provide an example of what you currently have and what you'd like to get instead.

3

Suppose my data is "a=1&c=1&a=2", if i use the kv filter, i will get:

a=[1,2]
c=1

Instead of creating an array for "a", i want it to be a regular string(either 1 or 2), any random value is fine.

4

See allow_duplicate_values. When in doubt, consult the documentation and look at what's available.

5

allow_duplicate_values works when the values are same for duplicate keys.
In my case the values are different and i want to pick one.

6

Oh, right. In that case you'll have to use a ruby filter to iterate over fields and turn array fields into scalar values.