Hey all,
We're currently trying to write a parser extension for Google Workplace Activities, as we found that key fields are not being mapped to UDM for some Google Groups changes.
The problem we're facing is that one input payload contains multiple events, each of which becomes a separate UDM event. When we're trying to map new fields for matching events, they're applied to all the output events.
filter {
json {
source => "message"
array_function => "split_columns"
}
mutate {
replace => { "event.idm.read_only_udm.target.resource.name" => "" }
}
statedump { "label" => "1" }
if [id][applicationName] == "groups_enterprise" {
for index1, item1 in events {
if [item1][name] == "change_acl_permission" {
for index2, parameter in item1.parameters {
if [parameter][name] == "group_email" {
mutate {
replace => {
"event.idm.read_only_udm.target.resource.name" => "%{parameter.value}"
}
}
}
}
}
}
}
mutate {
merge => {
"@output" => "event"
}
}
}The above code works, but sets `target.resource.name` on all the output UDM events, not just the ones where `name` is equal to `change_acl_permission`.
What do I need to change so that the items in `events` which don't match my conditional won't be altered? I'm new to parser development so let me know if I've missed something obvious. Thanks!