Open hegga opened 3 years ago
I am using JSON logging with JSON arrays like this:
'{"file.name": ["a.txt", "b.txt", "c.txt"]}'
In order to check if file.name contains "b.txt" today, I will have to do something like this:
parseJson() | split("file.name") | file.name =~ in(values=["b.txt"])
But this splits the events, which then will have to be joined based on the @id later on. Please consider to implement support JSON arrays so we can do something like this:
parseJson() | file.name =~ in(values=["b.txt"])
Without splitting the events.
I am using JSON logging with JSON arrays like this:
'{"file.name": ["a.txt", "b.txt", "c.txt"]}'In order to check if file.name contains "b.txt" today, I will have to do something like this:
parseJson() | split("file.name") | file.name =~ in(values=["b.txt"])But this splits the events, which then will have to be joined based on the @id later on. Please consider to implement support JSON arrays so we can do something like this:
parseJson() | file.name =~ in(values=["b.txt"])Without splitting the events.