- Observability: other versions:
- What is Elastic Observability?
- What’s new in 7.16
- Send data to Elasticsearch
- Spin up the Elastic Stack
- Deploy Elastic Agent to send data
- Deploy Beats to send data
- Elastic Serverless Forwarder for AWS
- Deploy serverless forwarder
- Configuration options
- Troubleshooting
- Observability overview page
- Application performance monitoring (APM)
- Log monitoring
- Metrics monitoring
- Synthetic monitoring
- User Experience
- Explore data
- Alerting
- Cases
- CI/CD Observability
- Fields reference
- Tutorials
IMPORTANT: No additional bug fixes or documentation updates
will be released for this version. For the latest information, see the
current release documentation.
Expanding events from JSON object lists
editExpanding events from JSON object lists
editYou can extract a list of events to be ingested from a specific field in the JSON file.
inputs: - type: "s3-sqs" id: "arn:aws:sqs:%REGION%:%ACCOUNT%:%QUEUENAME%" expand_event_list_from_field: "Records" outputs: - type: "elasticsearch" args: elasticsearch_url: "arn:aws:secretsmanager:eu-central-1:123456789:secret:es_url" username: "arn:aws:secretsmanager:eu-west-1:123456789:secret:es_secrets:username" password: "arn:aws:secretsmanager:eu-west-1:123456789:secret:es_secrets:password" es_datastream_name: "logs-generic-default"
You can define inputs.[].expand_event_list_from_field
as a string with the value of a key in the JSON that contains a list of elements that must be sent as events instead of the encompassing JSON.
When routing service logs, any value set for the expand_event_list_from_field
configuration parameter will be ignored, because this will be automatically handled by the Elastic Serverless Forwarder.
Was this helpful?
Thank you for your feedback.