Store multiple values using ruby in multivalue field

Elastic Stack Logstash
1

By nature all fields in elasticsearch are multivalue-enabled, i.e. they can have multiple values in one document. Using mutate filter it is easy to add multiple values, but I need to use ruby. I am trying to add multiple values using the logstash ruby even API, but only the last value added is kept, basically overwriting previous values.

Example:

event.set(field, 1);
event.set(field, 2)

I was hoping that field would contain 1 and 2 as values, but only value 2 is kept. Is there another event API call (append?) that can do this?

2

You would need an if-else similar to the ruby implementation of mutate+add_field.

3

Perfect, thanks!

The following works like a charm:

arrayfield=[]
arrayfield.push(1)
arrayfield.push(2)
event.set(field, arrayfield)

Now field contains two values: 1 and 2

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.