Hi there, I have the following data structure in Elasticsearch. { "id": "559466", "name": "test", "availability": [ { "assetId": "559466", "type": "pen", "complete": true, "availableFrom": "2005-01-01T00:00:00", "price": 3.99 }, { "assetId": "5…

If some events do not have the field then use if [availability] { filter{ split{ field => "availability" } } } You can either move the attributes to the root level using something like the code I linked to or you can refer to [availability][price]. Your choice.

Discuss the Elastic Stack

Split objects in a nested array into separate record

Elastic Stack Logstash

Badger September 29, 2020, 11:08pm 2

Use a split filter.

If, post-split, you want to move the fields of availability to the top-level, use a ruby filter, like this.

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.