Elasticsearch multiple values in one field

Question

I have a problem in ELK stack and I am not sure what is the cause of that. A lot of fields in my index have multiple values. For example:

records.Type Event, Event, Event, Event

records.EventCategory 1, 1, 1, 1, 1, 1, 1

records.EventLevelName Success, Success, Success, Success, Success, Success, Success

The implementation is quite easy and there's no fancy parsing in place. I am pulling logs with Logstash from EventHub and store them in Elastic. The only filter which is in place in Logstash is json filter:

filter {
  json {
    add_tag => [ "EventHub" ]
    source => "message"
    remove_field => [ "message" ]
  }
}

That's all. Nothing useful in logs either. Does anyone faced this problem? I couldn't find any helpful information.

Elasticsearch multiple values in one field

0 Answers