Using filters on nested fields

[shambar (Roger)]

I am having an issue trying to get logstash to see the items in the array beyond the first item.

the data will come in like.

{"id": "430229930",
"item_tbl" :[{"itemid": 1,"itemname":"eggs","quantity": 10},{"itemid": 2,"itemname":"milk","quantity": 10}]}

I can access the first item in the array by referencing [item_tbl][0][itemname]

I know the second item is [1] but how do I get logstash to mutate or manipulate all the items in the array?

the documents will vary on the number of items in the array.

I would like to use just basic filters like mutate on the fields.

[magnusbaeck (Magnus Bäck)]

I know the second item is [1] but how do I get logstash to mutate or manipulate all the items in the array?

That depends on the filter being used. Some support arrays and some don't. You may have to use a ruby filter to work around such limitations.

[shambar (Roger)]

I would like to use the mutate filter and rename itemname to item_name. I have not used ruby yet so there may be a bit of a learning curve for me to go that route.

[magnusbaeck (Magnus Bäck)]

What you want to do will require use of the ruby filter.