I'm sorry to ask this honestly.. normally I'm a decently smart fella.. but I can't seem to grasp this. I have some JSON coming that I need to split into individual documents.
Which then just throws _grokparsefailure, _split_type_failure
I've tried a bunch of different iterations, based on suggestions and articles I've found.. but even if I get the tags to go away, it still never splits the nodes into individual documents.
I can't say anything about the grok failure as you didn't include the configuration that has caused that. But your split problem is probably due to the fact that this is a hash, not an array. Using a ruby filter to change it might help? event.set("messages", event.get("messages").values)
If it doesn't work, please post the ruby debug output, so we'll know exactly what your current result looks like. And have a look at the Logstash logs. Wasn't the _split_type_failure accompanied by a warning?
As I said, the logs and rubydebug output would be of interest. You can barely debug something based on tags. The data might look different from than I think.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.