Split and access to array elements

Elastic Stack Beats
1

Hi,
I am trying to split a field and to register each element of the given array in new fields (filebeat 7.3.1).
url.array is well created as an array and contains my 2 elements. That's ok for that.

I've tried :

         {
            "split": {
                "field": "url.original",
                "separator": "\\?",
                "ignore_missing": true,
                "target_field": "url.array"
            }
        },
        {
            "set": {
                "field": "url.path",
                "value": " {{ctx.url.array[0] }}"
            }
        },

And also by using a processor :

 - extract_array:
    field: url.array
    mappings:
      url.path: 0
      url.query: 1
    ignore_missing: true
    omit_empty: true

But nothing is working :confused:

Anyone could help please ?
Thx

2

Finally I switched to logstash to be able to do more complex actions on logs.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.