{"action":"created","issue":{"url":"https://api.github.com/repos/elasticsearch/logstash/issues/2131","labels_url":"https://api.github.com/repos/elasticsearch/logstash/issues/2131/labels{/name}","comments_url":"https://api.github.com/repos/elasticsearch/logstash/issues/2131/comments","events_url":"https://api.github.com/repos/elasticsearch/logstash/issues/2131/events","html_url":"https://github.com/elasticsearch/logstash/issues/2131","id":50093768,"number":2131,"title":"Allow splitting of lists / arrays into multiple events","user":{"login":"agirbal","id":492434,"avatar_url":"https://avatars.githubusercontent.com/u/492434?v=3","gravatar_id":"","url":"https://api.github.com/users/agirbal","html_url":"https://github.com/agirbal","followers_url":"https://api.github.com/users/agirbal/followers","following_url":"https://api.github.com/users/agirbal/following{/other_user}","gists_url":"https://api.github.com/users/agirbal/gists{/gist_id}","starred_url":"https://api.github.com/users/agirbal/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/agirbal/subscriptions","organizations_url":"https://api.github.com/users/agirbal/orgs","repos_url":"https://api.github.com/users/agirbal/repos","events_url":"https://api.github.com/users/agirbal/events{/privacy}","received_events_url":"https://api.github.com/users/agirbal/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":6,"created_at":"2014-11-25T22:35:00Z","updated_at":"2015-01-29T01:31:18Z","closed_at":null,"body":"A very common pattern in JSON & XML is to make use of lists to group data together.\r\nFor example an XML file often looks like:\r\n```\r\n<root>\r\n    <some common data about this file ... />\r\n    <events>\r\n        <event ... />\r\n        <event ... />\r\n        <event ... />\r\n        ...\r\n    </events>\r\n<root/>\r\n```\r\n\r\nSame way in JSON, many SQL exports or API results look like this:\r\n```\r\n{ some-common-fields: ...,\r\n  results: [\r\n    { result ... },\r\n    { result ... },\r\n    { result ... },\r\n    ...\r\n] }\r\n```\r\n\r\nRight now logstash can't easily handle those \"groupings\" and require some external XSLT or script of some sort.\r\nInstead it would be great to extend the \"split\" command so that it can be applied to an array, after the initial data has been parsed.\r\nThe behavior would be: make each element of the array its own event, copying all other fields over.\r\nA flag could be used to disable copying the common fields.\r\nThis would be generic and applicable to any input format.\r\n\r\nFor example based on above JSON:\r\n```\r\n$ logstash -e 'input {} filter { split { json { source => \"message\" } split { arrayField => \"results\" } } } output {}'\r\n```\r\n\r\nCommon use cases:\r\n- many SQL dumps into XML / JSON\r\n- internet of things: many readings from the network come in grouped per device & time\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/elasticsearch/logstash/issues/comments/71952929","html_url":"https://github.com/elasticsearch/logstash/issues/2131#issuecomment-71952929","issue_url":"https://api.github.com/repos/elasticsearch/logstash/issues/2131","id":71952929,"user":{"login":"markwalkom","id":3184718,"avatar_url":"https://avatars.githubusercontent.com/u/3184718?v=3","gravatar_id":"","url":"https://api.github.com/users/markwalkom","html_url":"https://github.com/markwalkom","followers_url":"https://api.github.com/users/markwalkom/followers","following_url":"https://api.github.com/users/markwalkom/following{/other_user}","gists_url":"https://api.github.com/users/markwalkom/gists{/gist_id}","starred_url":"https://api.github.com/users/markwalkom/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/markwalkom/subscriptions","organizations_url":"https://api.github.com/users/markwalkom/orgs","repos_url":"https://api.github.com/users/markwalkom/repos","events_url":"https://api.github.com/users/markwalkom/events{/privacy}","received_events_url":"https://api.github.com/users/markwalkom/received_events","type":"User","site_admin":false},"created_at":"2015-01-29T01:31:18Z","updated_at":"2015-01-29T01:31:18Z","body":"Thanks to @jordansissel, here is a work around. Just change the values in the event field to match your array.\r\n\r\n```\r\nfilter {\r\n  ruby {\r\n    init => \"def filter(event, &block); event['[result][records]'].each { |o| yield LogStash::Event.new(o) }; event.cancel; end\"\r\n    code => \"hahaha\"\r\n  }\r\n}\r\n```"}}