Using filter on nested objects

[shambar (Roger)]

I am having an issue trying to get logstash to see the items in the array beyond the first item.

the data will come in like.

{"id": "430229930",
"item_tbl" :[{"itemid": 1,"itemname":"eggs","quantity": 10},{"itemid": 2,"itemname":"milk","quantity": 10}]}

I can access the first item in the array by referencing [item_tbl][0][itemname]

I know the second item is [1] but how do I get logstash to mutate or manipulate all the items in the array?

the documents will vary on the number of items in the array.

[magnusbaeck (Magnus Bäck)]

That depends on the filter(s) you want to use. Arrays of values aren't handled uniformly across all plugins.