on filter ,want to split and get a element from array but is not work on 7.0 and work with 6.4,6.5,code like:
mutate { split => ["message", " | "] add_field => { "ip" => "%{message[0]}" } }
data as: elem1 | elem2 | elem3 | elem4
other, I also want to get array lenth and get last element
thanks very much!
logstash no longer supports field references like message[0], it has to be [message][0]
add_field => { "ip" => "%{[message][0]}" "last" => "%{[message][-1]}" }
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
© 2020. All Rights Reserved - Elasticsearch
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.