Open poulinjulien opened 5 years ago
input { generator { lines => [ "1|2:3" ] count => 1 } }
filter { dissect { mapping => { "message" => "%{a}|%{b}" "b" => "%{c}:%{d}" } add_field => {"e" => "%{b}"} } }
output { stdout { codec => rubydebug } }
- Expected output:
{ "a": "1", "b": "2:3", "c": "2", "d": "3", "e": "2:3" }
- Actual output:
{ "a": "1", "b": "2:3", "c": "2", "d": "3", "e": [ "2:3", "2:3" ] }
Confirmed on 7.0.0 too.
Investigating.
filter { dissect { mapping => { "message" => "%{a}|%{b}" "b" => "%{c}:%{d}" } add_field => {"e" => "%{b}"} } }
output { stdout { codec => rubydebug } }
{ "a": "1", "b": "2:3", "c": "2", "d": "3", "e": "2:3" }
{ "a": "1", "b": "2:3", "c": "2", "d": "3", "e": [ "2:3", "2:3" ] }