What if it is not an array after split?

Elastic Stack Logstash
1

I want to treat an array as an if statement.

mutate {
split => [ "cookie_ids", ";" ]
}
if [cookie_ids][0] {
mutate {
add_field => [ "cookie_id", "%{cookie_ids[0]}" ]
}
}
else {
mutate {
add_field => [ "cookie_id", "-" ]
}
}

[2018-10-16T17:20:24,000][WARN ][org.logstash.FieldReference] Detected ambiguous Field Reference cookie_ids[0], which we expanded to the path [cookie_ids, 0]; in a future release of Logstash, ambiguous Field References will not be expanded.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.