My goal is to have a match between the i value of the first field and the i value of the second field (as seen in my first post). Is this goal achieved with multiple split filters?
split { field => "field1" }
split { field => "field2" }
will produce four events, one for each pairing: a/c, a/d, b/c, b/d.
If you want the two events then you could do it in ruby. Your sample data has three value1 and only one value2, so this may be the wrong pairing (this results in a/c, b/d)
ruby {
code => '
f1 = event.get("field1")
f2 = event.get("field2")
if f1.is_a? Array and f2.is_a? Array and f1.length == f2.length
a = []
f1.each_index { |x|
a << { "field1" => f1[x], "field2" => f2[x] }
}
event.set("[@metadata][stuff]", a)
end
'
}
if [@metadata][stuff] {
split { field => "[@metadata][stuff]" }
mutate {
replace => {
"field1" => "%{[@metadata][stuff][field1]}"
"field2" => "%{[@metadata][stuff][field2]}"
}
}
}
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.