Splitting on one element only, in array field causes additional suffix
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 45/100
Research direction
Start with the split filter configuration and the provided stdin JSON, focusing on the Series field when it contains one element. Compare the rubydebug output with the expected single-event representation and determine whether the added sequence suffix is reproducible and what behavior should be considered correct.
Written by the indexing model from the issue text.
Description
Hi all,
I have this as my logstash.conf
input {
stdin {
}
}
filter {
split {
field => "Series"
}
}
}
output {
stdout {
codec => rubydebug
}
}
Normally, the content of the "Series" has more than one element, but for some reason sometime it outputs only one element. The Input is like this
{"Series":[{"DataType":"AirQuality.1","Timestamp":"2016-03-07T03:36:03.119000Z","DataKeyValuePairs":{"aqi":"0","om":"a","pwr":"0","cl":"0","aqil":"0","fs1":"112","fs2":"960","fs3":"2880","fs4":"2880","dtrs":"0","aqit":"29","clef1":"n","repf2":"n","repf3":"n","repf4":"n","fspd":"1","tfav":"130","psens":"1"}}]}
For some reason on the output side is adding a sequence as suffix, like this
"@version" => "1",
"@timestamp" => "2016-03-08T14:20:30.475Z",
"Series" => [
[0] {
"DataType" => "AirQuality.1",
"Timestamp" => "2016-03-07T03:36:03.119000Z",
"DataKeyValuePairs" => {
"aqi" => "0",
"om" => "a",
"pwr" => "0",
"cl" => "0",
"aqil" => "0",
"fs1" => "112",
"fs2" => "960",
"fs3" => "2880",
"fs4" => "2880",
"dtrs" => "0",
"aqit" => "29",
"clef1" => "n",
"repf2" => "n",
"repf3" => "n",
"repf4" => "n",
"fspd" => "1",
"tfav" => "130",
"psens" => "1"
}
}
]
Is this a known bug?
- Dominant language
- Ruby
- Stars
- 6
- Forks
- 29
- PR merge metrics
- No merged PRs in 30d
Getting set up
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from logstash-plugins/logstash-filter-split
-
enhancement status:needs-triage
Difficulty 5/5 Over a week Newbie friendliness 35/100
-
enhancement
Difficulty 5/5 Over a week Newbie friendliness 25/100
-
bug
Difficulty 3/5 1-2 days Newbie friendliness 45/100
logstash-plugins/logstash-filter-split#47 · 1 comment · 1 reaction ·
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
logstash-plugins/logstash-filter-split#42 · 1 comment ·
-
Difficulty 3/5 1-2 days Newbie friendliness 35/100
logstash-plugins/logstash-filter-split#38 · 1 reaction ·
All issues in logstash-plugins/logstash-filter-split
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
-
security
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
IBM/ai-security-baseline#25 ·
-
security
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
Maintainers usually reply within 1 day
-
Mend: dependency security vulnerability
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
Maintainers usually reply within 1 day
-
Mend: dependency security vulnerability
Difficulty 2/5 1-3 hours Newbie friendliness 62/100