Question
Can you use the split
filter with a dynamic field ("%{some_field}"
)?
Problem
The documentation doesn't say (Split filter) and the intuitive split { field => "%{test}" }
doesn't seem to work. Test case below:
Test Case:
{"test":"bar","bar":[{"m":"hello"},{"m":"world"}]}
Logstash conf file:
input {
stdin {
codec => json
}
}
filter {
split {
field => "%{test}"
}
}
output {
stdout { codec => rubydebug { metadata => true } }
}