Resolve mapping conflicts (kinda) automatically?

[TheEvilDonut (Luc Desaulniers)]

So here's our situation.

Most of our applications use an object field named (fictional) "foo" so

foo.field_a
foo.field_b
foo.field_c
etc...

But from time to time a "rogue log" will come in and will contain a string field named "foo" and thus be rejected due to being in conflict.

My question is, could there be a way to detect a field as NOT being an object? If so I could do something like this :

if foo is not an object {
   rename foo to foo_string
}

Anyways to do this or am I screwed?

[Badger]

You could try

ruby {
     code => '
        foo = event.get("foo")
        if ! foo.is_a? Hash
            event.set("foo_string", event.remove("foo"))
        end
    '
}

[TheEvilDonut (Luc Desaulniers)]

Looks interesting. Giving this a try.

Thanks!