Ensure responses with large tables produce a single array with no duplicated elements

[jsvd]

There are reports of network devices producing responses where an ifTable is over 32 elements, causing it to be split into two arrays, or produce an array where entries have the same index. This may come from the snmp4j library.

Currently a workaround by @kares is to use a ruby filter script https://gist.github.com/kares/04b7bf88c1fb5ac9e59b5a48dc2c04e5#file-merge_array_hash-rb-L39= like so:

filter { 
  ruby { 
    path => '/opt/logstash/scripts/merge_array_hash.rb' 
    script_params => { 
      fields => ['interfaces'] 
      merge_key => 'index' 
    }
  }
}

Work is required to investigate why data arrives at the Logstash Event with these arrays, to understand if it is a bug in the snmp4j library or a setting that needs to be tweaked in the source network device