i have a question about tie events together with subfields,log file like following:
LOG FILE
id 1 name paris-1-university city paris country French
id 1 namestu cici age 18 sex F
id 1 name paris-3-university city london country England
id 1 namestu toto age 21 sex M
... ...
structure i want, like the following:
{
_id": "1",
"schstu1": {
"sch": {
"name": "paris-1-university",
"city": "paris",
"country": "French",
},
"stu": {
"namestu": "cici",
"age": "18",
"sex": "F",
}
}
"schstu2": {
"sch": {
"name": "paris-3-university",
"city": "london",
"country": "England",
},
"stu": {
"namestu": "toto",
"age": "21",
"sex": "M",
}
}
"schstu3" {
.....
}
"schstu4" {
.....
}
}
but now, t try to use logstash to index data into Elasticsearch (tie mulitiline by "id"),the result is like the following:
{
_id": "1",
"schstu1": {
"sch": {
"name":[
"paris-1-university",
"paris-3-university"
]
"city": [
"paris",
"london"
]
"country":[
"French",
"England"
]
},
"stu": {
"namestu": [
"cici",
"toto"
]
"age": [
"18",
"21"
]
"sex":[
"F",
"M"
]
}
}
}
how can i fix these problem, anyone can help, thanks advance