cawoodm
(Marc)
March 19, 2018, 3:46pm
1
We want to split a URL into it's path components and apply some logic based on parts of the URL.
Filter:
mutate {
copy => {"url" => "path"}
split => {"path" => "/"}
}
Result:
{
...
"url" => "/foo/bar/20771042",
"path" => "/foo/bar/20771042",
...
}
We were expecting an array but path looks (in LogStash console and Kibana) to be a simple string.
Using split => ["path", "/"]
or split => {"path" => "\/"}
makes no difference.
Shouldn't path
become an array like ["foo", "bar", ...]
?
cawoodm
(Marc)
March 20, 2018, 8:10am
3
Yep, splitting the mutate solves the non-splitting split!
mutate { copy => {"url" => "path"} }
mutate { split => {"path" => "/"} }
Result:
"path" => [
[0] "",
[1] "bcpstorefront",
[2] "otherlink2"
]
Bonus Question: Any neat way to remove the empty ``[0] "" entry?
cawoodm
(Marc)
March 20, 2018, 12:42pm
4
Gottit!
mutate { remove_field => ["path[0]"] }
system
(system)
Closed
April 17, 2018, 12:42pm
5
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.