From da46138fdce64c38932716a0a497e8cd486f9e48 Mon Sep 17 00:00:00 2001 From: Glen Smith Date: Tue, 29 Nov 2016 17:58:25 -0700 Subject: [PATCH 1/4] ingest-node.asciidoc - Clarify json processor --- docs/reference/ingest/ingest-node.asciidoc | 28 ++++++++++++++++++++-- 1 file changed, 26 insertions(+), 2 deletions(-) diff --git a/docs/reference/ingest/ingest-node.asciidoc b/docs/reference/ingest/ingest-node.asciidoc index 808fe549ae99c..e90395c16a8a5 100644 --- a/docs/reference/ingest/ingest-node.asciidoc +++ b/docs/reference/ingest/ingest-node.asciidoc @@ -1475,11 +1475,35 @@ Converts a JSON string into a structured JSON object. | `target_field` | no | `field` | The field to insert the converted structured object into |====== +Suppose you provide this configuration of the `json` processor: + +[source,js] +-------------------------------------------------- +{ + "json" : { + "field" : "string_source", + "target_field" : "json_target" + } +} +-------------------------------------------------- + +If the following document is processed: + +[source,js] +-------------------------------------------------- +{ + "string_source": "{\"foo\": 2000}" +} +-------------------------------------------------- + +after the `json` processor operates on it, it will look like: + [source,js] -------------------------------------------------- { - "json": { - "field": "{\"foo\": 2000}" + "string_source": "{\"foo\": 2000}", + "json_target": { + "foo": 2000 } } -------------------------------------------------- From afed59a0158dd2f57427980a6f575b1e8169c2e3 Mon Sep 17 00:00:00 2001 From: Glen Smith Date: Tue, 29 Nov 2016 18:11:04 -0700 Subject: [PATCH 2/4] Update ingest-node.asciidoc --- docs/reference/ingest/ingest-node.asciidoc | 23 ++++++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/docs/reference/ingest/ingest-node.asciidoc b/docs/reference/ingest/ingest-node.asciidoc index e90395c16a8a5..773b0f4829c28 100644 --- a/docs/reference/ingest/ingest-node.asciidoc +++ b/docs/reference/ingest/ingest-node.asciidoc @@ -1508,6 +1508,29 @@ after the `json` processor operates on it, it will look like: } -------------------------------------------------- +If the following configuration had been provided, omitting the optional `target_field` setting: +[source,js] +-------------------------------------------------- +{ + "json" : { + "field" : "source_and_target" + } +} +-------------------------------------------------- + +then after the `json` processor operated on the same document, it would have looked like: + +[source,js] +-------------------------------------------------- +{ + "source_and_target": { + "foo": 2000 + } +} +-------------------------------------------------- + +because, by default, the `target_field` is the same field provided in the required `field` configuration. + [[lowercase-processor]] === Lowercase Processor Converts a string to its lowercase equivalent. From fcc08752ac756fb855a0c8da49d495c4bcbec24f Mon Sep 17 00:00:00 2001 From: Glen Smith Date: Mon, 17 Apr 2017 20:58:07 -0600 Subject: [PATCH 3/4] restore doc markups lost in merge --- docs/reference/ingest/ingest-node.asciidoc | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/docs/reference/ingest/ingest-node.asciidoc b/docs/reference/ingest/ingest-node.asciidoc index d71e9f074bdc3..0f3108b9155a7 100644 --- a/docs/reference/ingest/ingest-node.asciidoc +++ b/docs/reference/ingest/ingest-node.asciidoc @@ -1582,11 +1582,16 @@ This processor helps automatically parse messages (or specific event fields) whi For example, if you have a log message which contains `ip=1.2.3.4 error=REFUSED`, you can parse those automatically by configuring: - +[source,js] + --------------------------------------------------- + { "kv": { "field": "message", "field_split": " ", "value_split": "=" + } +} +--------------------------------------------------- [[kv-options]] .Kv Options From 5376dc351c12ef939ff0221c82bbbc706ced04b6 Mon Sep 17 00:00:00 2001 From: Glen Smith Date: Mon, 17 Apr 2017 21:05:56 -0600 Subject: [PATCH 4/4] cleaning up kv processor (to get it back as it was) --- docs/reference/ingest/ingest-node.asciidoc | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/docs/reference/ingest/ingest-node.asciidoc b/docs/reference/ingest/ingest-node.asciidoc index 0f3108b9155a7..8009f67e8e90c 100644 --- a/docs/reference/ingest/ingest-node.asciidoc +++ b/docs/reference/ingest/ingest-node.asciidoc @@ -1582,16 +1582,17 @@ This processor helps automatically parse messages (or specific event fields) whi For example, if you have a log message which contains `ip=1.2.3.4 error=REFUSED`, you can parse those automatically by configuring: + [source,js] - --------------------------------------------------- - { +-------------------------------------------------- +{ "kv": { "field": "message", "field_split": " ", "value_split": "=" } } ---------------------------------------------------- +-------------------------------------------------- [[kv-options]] .Kv Options @@ -1606,6 +1607,7 @@ For example, if you have a log message which contains `ip=1.2.3.4 error=REFUSED` | `ignore_missing` | no | `false` | If `true` and `field` does not exist or is `null`, the processor quietly exits without modifying the document |====== + [[lowercase-processor]] === Lowercase Processor Converts a string to its lowercase equivalent.