+ if [type] != "dmaap_log" {
+ # avoid noise if no entry in the list
+ if [message] == "[]" {
+ drop { }
+ }
+
+ json {
+ source => "[message]"
+ target => "message"
+ }
+# ruby {
+# code => "event.get('message').each{|m| m.set('type',event.get('type')}"
+# }
+ split {
+ field => "message"
+ add_field => {
+ "type" => "%{type}"
+ "topic" => "%{topic}"
+ }
+ }
+
+ json {
+ source => "message"
+ }
+
+ mutate { remove_field => [ "message" ] }