Hi All,
I am wondering if someone has implemented multi value fields at index time similar to the following
The following is a json event and has a common field i.e. "field1" and then in the "event" field, it has multiple values. Is it possible at index time to ingest these values as single line and attach the common field "field1" value in front of each event. e.g.
{
"fields": {
"field1": "value0"
},
"event": "2 123456789123 value1 value2 value3 value4\n2 123456789123 value5 value6 value7 value8\n2 123456789123 value9 value10 value11 value12\n2 123456789123 value13 value14 value15 value16\n2"
}
Expected Output:
value0 2 123456789123 value1 value2 value3 value4
value0 2 123456789123 value6 value6 value7 value8
value0 2 123456789123 value9 value10 value11 value12
value0 2 123456789123 value13 value14 value15 value16
Note: I understand this can be done at the Search Time and I have done that. I am trying to find a way to achieve it at index time using props and transforms.
... View more