LogStash過濾器 - 骨料複製事件併合並其

Question

鑑於這三個LogStash事件，紅寶石哈希

{ 
    "id" => "1", 
    "address_unit" => "1", 
    "address_sqft" => 1098, 
    "address_city" => "NEW YORK" 
} 

{ 
    "id" => "1", 
    "address_unit" => "1", 
    "address_sqft" => 1090, 
    "address_city" => "NEW YORK" 
} 


{ 
    "id" => "1", 
    "address_unit" => "1", 
    "address_sqft" => 2000, 
    "address_city" => "NEW YORK" 
} 

這應該被存儲到ES作爲

{ 
    "id" => "1", 
    "address_unit" => "1", 
    "address_sqft" => [1098, 1090, 2000], 
    "address_city" => "NEW YORK" 
} 

我想知道是否有一些內置/社區過濾器來實現它，或者如何使用ruby代碼實現它。

謝謝！

Answer 1

，如果你進入的散列像a和b可以使用

[15] pry(main)> a 
=> {"id"=>"1", "address_unit"=>"1", "address_sqft"=>1098, "address_city"=>"NEW YORK"} 
[16] pry(main)> b 
=> {"id"=>"1", "address_unit"=>"1", "address_sqft"=>1090, "address_city"=>"NEW YORK"} 
[17] pry(main)> a.merge(b) {|_, old_val, new_val| old_val==new_val ? old_val : ([old_val] << new_val).flatten} 
=> {"id"=>"1", "address_unit"=>"1", "address_sqft"=>[1098, 1090], "address_city"=>"NEW YORK"}