Split document into multiple documents

Elastic Stack Logstash
9

Sure you can do

        f1 = event.get("field1")
        f2 = event.get("field2")
        f3 = event.get("field3")
        f4 = event.get("field4")
        f5 = event.get("field5")
        f6 = event.get("field6")
        f7 = event.get("field7")

        if f1.is_a? Array and f2.is_a? Array and f3.is_a? Array and f4.is_a? Array and f5.is_a? Array and f6.is_a? Array and f7.is_a? Array and f1.length == f2.length and f1.length == f3.length and f1.length == f4.length ...
            a = []
            f1.each_index { |x|
                a << {
                    "field1" => f1[x], "field2" => f2[x], "field3" => f3[x], 
                    "field4" => f4[x], "field5" => f5[x], "field6" => f6[x], 
                    "field7" => f7[x] 
                }
            }
            event.set("[@metadata][stuff]", a)
        end
1 Like