I have this error with split filter in logstash .
"Only String and Array types are splittable. field:[log] is of type = NilClass"
I am trying to create events for each object in an array of objects but cannot figure out the syntax for array filed which needs to be used in the split filter.
I need to know how to reference the "log" array in the split filter.
Here is my data (this is prettified json) .
{"log": [
{
"agent": "Mozilla/5.0 (compatible; MSIE 9.0)",
"ip": "192.168.24.44",
"request": "/index.html"
"response": {
"status": 200,
"bytes": 52353
},
"ua": {
"os": "Windows 7"
}
},
{
"agent": "Mozilla/5.0 (compatible; MSIE 9.0)",
"ip": "192.168.24.44",
"request": "/index.html"
"response": {
"status": 200,
"bytes": 52353
},
"ua": {
"os": "Windows 7"
}
}
]
}
And my config is
input {
file {
type => "json"
codec => multiline {
pattern => ",\n{"
negate => true
what => previous
auto_flush_interval => 5
#max_lines => 20000
}
sincedb_path => "/dev/null"
start_position => "beginning"
path => "/etc/logstash/ingest/log.log"
}
}
filter {
split {
field => "[log]"
target=> "message"
terminator => ",\n{"
}
}
output {
file {
path => "/etc/logstash/output/result.txt"
codec => "rubydebug"
}
}
Any help would be very much appreciated. Thanks