Split and store tags

[rodrigue]

Hello,
Sorry to bother you but I tried everything...
Il simply would like to take tags from my json and store it as a tag in logstash...

Here is my configuration

input {
    http {
        port => "5046"
        tags => ["log-from-http"]
    }
}

filter {
    if "log-from-http" in [tags] {
        json {
            source => "message"
            target => "logFromHttp"
        }
        mutate {
            remove_field => ["headers"]
        }
        mutate {
            add_tag => ['%{[logFromHttp][tags]}']
        }
    }
}
output {
    if "log-batiimmo-dev" in [tags] {
        file {
            codec => rubydebug
            path => "/home/leopold/tmp/logstash.log"
        }
    }
}

I send this json on the http port

{
    "key1": "value1",
    "key2": "value2",
    "key3": "value3",
    "tags": ["tag1", "tag2"]
}

And, in the end my problem is that the tags are concatenated together : (result from file output when I remove the "if")

tags => [
[0] "log-from-http"
[1] "tag1,tag2"
]

What I want to achieve is

tags => [
 [0] "log-from-http"
 [1] "tag1"
 [2] "tag2"
]

Could you please tell me what I'm doing wrong ? (I stried with split, I tries split with terminator=",", nothing works... )

[Badger]

When you use a sprintf reference the field is converted to a string before it is used. If you want to add each member of the array then use ruby

    ruby {
        code => '
            tags = event.get("[logFromHttp][tags]")
            if tags.is_a? Array
                tags.each { |x|
                    event.tag(x)
                }
            end
        '
    }

[rodrigue]

Thanks :)... It works...