Resolve mapping conflicts (kinda) automatically?

So here's our situation.

Most of our applications use an object field named (fictional) "foo" so :slight_smile:


But from time to time a "rogue log" will come in and will contain a string field named "foo" and thus be rejected due to being in conflict.

My question is, could there be a way to detect a field as NOT being an object? If so I could do something like this :

if foo is not an object {
   rename foo to foo_string

Anyways to do this or am I screwed? :sweat_smile:

You could try

ruby {
     code => '
        foo = event.get("foo")
        if ! foo.is_a? Hash
            event.set("foo_string", event.remove("foo"))

Looks interesting. Giving this a try.


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.