Split Filter Parse Failure - Only String and Array types are splittable

I have this error with split filter in logstash .
"Only String and Array types are splittable. field:[log] is of type = NilClass"

I am trying to create events for each object in an array of objects but cannot figure out the syntax for array filed which needs to be used in the split filter.

I need to know how to reference the "log" array in the split filter.
Here is my data (this is prettified json) .

{"log": [
	{
	  "agent": "Mozilla/5.0 (compatible; MSIE 9.0)",
	  "ip": "192.168.24.44",
	  "request": "/index.html"
	  "response": {
		"status": 200,
		"bytes": 52353
	  },
	  "ua": {
		"os": "Windows 7"
	  }
	},
	{
	  "agent": "Mozilla/5.0 (compatible; MSIE 9.0)",
	  "ip": "192.168.24.44",
	  "request": "/index.html"
	  "response": {
		"status": 200,
		"bytes": 52353
	  },
	  "ua": {
		"os": "Windows 7"
	  }
	}
]
}

And my config is

input {
  file {
        type => "json"
	codec => multiline {
        pattern => ",\n{"
        negate => true
        what => previous
		auto_flush_interval  => 5
		#max_lines => 20000
      } 
	sincedb_path => "/dev/null"
	start_position => "beginning"
        path => "/etc/logstash/ingest/log.log"
   
  }
}
filter {

	split { 
		field => "[log]" 
		target=> "message"
		terminator => ",\n{"
	}
}
output {
	
	file {
	   path => "/etc/logstash/output/result.txt"
	   codec => "rubydebug"
	 }
}

Any help would be very much appreciated. Thanks

Please use markdown to format your post. Edit your post, select the configuration, and click on </> in the toolbar above the edit pane. Then do the same with your data.

Thanks, I have edited the code section.

Why would you need a split filter if you have already combined each JSON object into a single event using the multiline codec? I would not expect any event except (possibly) the first to contain a [log] field.

For some reason the multiline does not split the obejects. It passes the whole payload to the filters

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.