Split HTTP Poller Responses to Multiple Documents using Split Filter

Elastic Stack Logstash
3

If you want another event then the easiest way is to have the split filter create it for you. You could try something like

    code => '
        dependency = []
        event.get("entries").each { |k, v|
            v["dep_name"] = k
            dependency << v
        }

        e = event.to_hash
        e.remove("entries")
        e["isSpecial"] = true
        dependency << e

        event.set("dependency", dependency)
    '

then after the split

if [dependency][isSpecial] {
    ruby {
        code => '
            event.remove("dependency").each { |k, v|
                event.set(k,v)
            }
        '
    }
}