0

I'm trying to access array element after splitting a string into array using a 'split' processor in an ingest node pipeline?

I have a long string separated by slash ('/'). I only want to pass one substring to index, and dump the rest.

For example, I have a string "/aaa/bbb/ccc". I only want to index "ccc".

My current idea is to use split + set + remove, but I don't know how to access the array element after splitting.

PS: Is there a solution if I use Logstash?

user8205208
  • 1
  • 1

1 Answers1

0

You can use the script processor

POST _ingest/pipeline/_simulate
{
  "pipeline" :
  {
    "description": "_description",
    "processors": [
      {
        "script" : {
          "inline" : "ctx.foo = ctx.foo.substring(ctx.foo.lastIndexOf('/') + 1)"
        }
      }
    ]
  },
  "docs": [
    {
      "_index": "index",
      "_type": "type",
      "_id": "id",
      "_source": {
        "foo": "/divided/by/slashes"
      }
    }
  ]
}

which returns

{
    "docs": [
      {
          "doc": {
              "_id": "id",
              "_type": "type",
              "_index": "index",
              "_source": {
                  "foo": "slashes"
              },
              "_ingest": {
                 "timestamp": "2017-06-23T14:53:46.871Z"
              }
           } 
       }
   ]

}

Note that this is not fully failsafe, but should give you a first idea.

alr
  • 1,744
  • 1
  • 10
  • 11
  • Thank you very much, alr! I have another question: What if the string is "/aaa/bbb/ccc/ddd/eee" and I want "ccc"? How to check if "ccc" is an integer? – user8205208 Jun 23 '17 at 18:38
  • you can extract that field first and then try to convert it to a number using the `convert` processor – alr Jun 23 '17 at 19:01
  • "ccc" can be a string of letters, or an integer number. I want to check if it's an integer first. Where did you find functions like lastIndexOf()? Thank you! – user8205208 Jun 23 '17 at 19:17