Hi
I've been looking at similar QA on similar topic, and couldn't find an applicable answer. I think I have a simple case, i.e., I get records of form:
who="Mr. boo", A1=v1,A2=v2
and what I would like to get are 2 records:
{who:"Mr. boo",
A_type:A1,
A_val:v1}
{who:Mr. boo",
A_type:A2,
A_val:v2}
My initial attempt was to use 2 grok filters:
who=%{DATA:who},%{DATA:A_type}=%{NUMBER:A_val},%{GREEDYDATA:skip}
who=%{DATA:who},%{GREEDYDATA:skip},%{DATA:A_type}=%{NUMBER:A_val}
This gives me:
{who:["Mr. boo","Mr. boo"],
A_type:[A1,A2],
A_val:[v1,v2]}
I not sure how to split these arrays into separate events.
Setup: LS 2.2.4, ES:2.4.1(Lucene:5.5.2) and Kibana:4.4.2
Cheers,