Splitting the data in logstash

Elastic Stack Logstash
1

I have a field 'brief' in the below format.

"brief": [
{rx-usage: 0.0,
tx-stats: {tx-errors: 0, tx-bytes: 3597278194, tx-bps: 1808, tx-pps: 3, tx-packets: 8620093},
name: vni-0/0, host-inf: eth1, if-oper-status: up,
rx-stats: {rx-packets: 1088458, rx-pps: 2, rx-bps: 1392, rx-errors: 0, rx-bytes: 67069272},
tx-usage: 0.0},

{rx-usage: 0.0,
tx-stats: {tx-errors: 0, tx-bytes: 2105140374, tx-bps: 14464, tx-pps: 11, tx-packets: 12370683},
name: vni-0/1, host-inf: eth2, if-oper-status: up,
rx-stats: {rx-packets: 19948899, rx-pps: 9, rx-bps: 12760, rx-errors: 0, rx-bytes: 6312190688}, tx-usage: 0.0}
]

I try to have the following.

"brief"=[
{rx-usage: 0.0,
tx-stats: {tx-errors: 0, tx-bytes: 3597278194, tx-bps: 1808, tx-pps: 3, tx-packets: 8620093},
name: vni-0/0, host-inf: eth1, if-oper-status: up,
rx-stats: {rx-packets: 1088458, rx-pps: 2, rx-bps: 1392, rx-errors: 0, rx-bytes: 67069272},
tx-usage: 0.0}]

"brief"=[
{rx-usage: 0.0,
tx-stats: {tx-errors: 0, tx-bytes: 3597278194, tx-bps: 1808, tx-pps: 3, tx-packets: 8620093},
name: vni-0/0, host-inf: eth1, if-oper-status: up,
rx-stats: {rx-packets: 1088458, rx-pps: 2, rx-bps: 1392, rx-errors: 0, rx-bytes: 67069272},
tx-usage: 0.0}]

please help to split the data?

Thanks in Advance

2

If you are saying you want to split an array into one event for each value in the array then use a split filter.

3

@badger when I use split filter, it is saying "Only String and Array types are splittable. field:[brief] is of type = NilClass"

split{
field => "[brief]"
}

4

That is telling you that the field does not exist on some events.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.