Movatterモバイル変換

[0]ホーム
URL:

Loading
  1. Elastic Docs/
  2. Reference/
  3. Ingestion tools/
  4. Beats/
  5. Filebeat/
  6. Configure/
  7. Processors

Extract array

Theextract_array processor populates fields with values read from an array field. The following example will populatesource.ip with the first element of themy_array field,destination.ip with the second element, andnetwork.transport with the third.

The following settings are supported:

field
The array field whose elements are to be extracted.
mappings
Maps each field name to an array index. Use 0 for the first element in the array. Multiple fields can be mapped to the same array element.
ignore_missing
(Optional) Whether to ignore events where the array field is missing. The default isfalse, which will fail processing of an event if the specified field does not exist. Set it totrue to ignore this condition.
overwrite_keys
Whether the target fields specified in the mapping are overwritten if they already exist. The default isfalse, which will fail processing if a target field already exists.
fail_on_error
(Optional) If set totrue and an error happens, changes to the event are reverted, and the original event is returned. If set tofalse, processing continues despite errors. Default istrue.
omit_empty

(Optional) Whether empty values are extracted from the array. If set totrue, instead of the target field being set to an empty value, it is left unset. The empty string (""), an empty array ([]) or an empty object ({}) are considered empty values. Default isfalse.

[8]ページ先頭
©2009-2026 Movatter.jp