Multiple field mappings not supported?

[Dom-nik]

• Version: Logstash 5.0, not sure how to check the plugin version
• Operating System: CentOS 7
• Config File (if you have sensitive info, please remove it): details below
• Sample Data: taken from here

Hello,
I tried to setup the plugin to handle multiple field mappings and it fails, mostly returning an #<TypeError: can't convert nil into String>} error.

I tested a couple of versions of config file. For debugging purposes I introduced some extra logging in the loop that parses the fields array:

@fields.each do |old_key, new_key|
        @logger.warn("Keys:", :old_key => old_key, :new_key => new_key) # MY CODE HERE ;]

Here are the fragments of the config file that I tried along with log lines they produce:

1. fields => [{"date" => "new_date"}, {"title" => "new_title"}]

`[2016-11-02T16:20:44,381][WARN ][logstash.filters.elasticsearch] Keys: {:old_key=>{"date"=>"new_date"}, :new_key=>nil}

2. fields => ["date", "title"]

[2016-11-02T16:24:01,173][WARN ][logstash.filters.elasticsearch] Keys: {:old_key=>"date", :new_key=>nil}

3. fields => [{"date" => "new_date", "title" => "new_title"}]
   returns an error:

[ERROR][logstash.agent ] fetched an invalid config

To prove that querying ES works, I can assure that my case works for a single field config like this: fields => {"date" => "new_date"}, basically a replica of the config provided in the plugin docs.

[dejwoo]

Hey @Dom-nik, I have just spent hour trying to get this thing done, and right syntax to use is
fields => [["from","to"],["from","to"],["from","to"],["from","to"]]

[Dom-nik]

Thank you a lot @dejwoo!
Do you know how can I add this to the docs?

[webmat]

Sorry for the delay here.

Yeah Hash notation in Logstash configs is somewhat Ruby-like, which can cause confusion. It's documented here.

Some hash examples are:

attr => {
  "key1" => "value1"
  "key2" => "value2"
}

Or single line (notice there's no comma):

attr => { "key1" => "value1" "key2" => "value2" }

And tuples work as well, as @dejwoo pointed out.