We tried formatting the message with logstash to the desired format and pushing that to Kafka but somehow logstash would always create an array but not an object "tags".
It turns out when coming from logstash there is an internal (unchangeable) identifier called "tags", which will always be an array and never and object (https://discuss.elastic.co/t/add-tag/61837):
add_tag always adds the string to an array in the field named tags. The name of the tags field isn't configurable.
Even if we don't use the function add_tag logstash will create an array of the data provided. This is unfortunate.
Is it possible to make the name of the field "tags" configurable so that it could be renamed on the providing / the Kafka side?
We tried formatting the message with logstash to the desired format and pushing that to Kafka but somehow logstash would always create an array but not an object "tags".
It turns out when coming from logstash there is an internal (unchangeable) identifier called "tags", which will always be an array and never and object (https://discuss.elastic.co/t/add-tag/61837):
Even if we don't use the function add_tag logstash will create an array of the data provided. This is unfortunate.
Is it possible to make the name of the field "tags" configurable so that it could be renamed on the providing / the Kafka side?