What is the issue with below extension code:
filter {
json {
source => "message"
array_function => "split_columns"
}
if [debugContext][debugData][proxyType] != "" {
mutate {
replace => {
"proxyType.key" = "proxyType"
"proxyType.value" = "%{debugContext.debugData.proxyType}"
}
copy => {
"event1.idm.read_only_udm.security_result.detection_fields" => "proxyType"
}
}
}
mutate {
merge => {
"@output" => "event1"
}
}
}
Error:
generic::unknown: pipeline.ParseLogEntry failed: LOG_PARSING_CBN_ERROR: "generic::invalid_argument: failed to convert raw output to events: failed to convert raw message 0: field \\"idm\\": index 0: recursive rawDataToProto failed: field \\"read_only_udm\\": index 0: recursive rawDataToProto failed: field \\"security_result\\": failed to make strategy: received non-slice or non-array raw output for repeated field"
Objective: Trying to extract
debugContext.debugData.proxyType to UDM under security_result.detection_fields