我必须在pipeline.yml文件中为elasticsearch编写一个摄取管道。我能够用grok检索我的字段，并且能够用split处理器将其除。现在，我想将split操作产生的数组的每个值赋给它自己的字段。
但是我无法访问拆分数组的元素，相关代码片段如下所示：

- grok:
  field: message
  patterns:
    - ^TRIGGER OCCURRED. %{GREEDYDATA:pac.log.deo.trigger.path}
  tag: TRIGGER

  - split:
  if: ctx.pac.log.tags != null && ctx.pac.log.tags.contains('TRIGGER')
  field: '@metadata.pac.log.deo.trigger.path'
  separator: "/"

- set:
  if: ctx.pac.log.tags != null && ctx.pac.log.tags.contains('TRIGGER')
  field: pac.log.deo.trigger.provider
  value: '{{{@metadata.pac.log.deo.trigger.path[0]}}}'

日志行将如下所示：

TRIGGER OCCURRED: Timer/Period [seconds]/10 seconds

如果elasticsearch索引和其他oop语言数组索引以0开始，我希望第一个值=索引0，存储在字段pac.log.deo.trigger.provider中
我尝试了各种注解：

'{{{@metadata.pac.log.deo.trigger.path[0]}}}'
'{{@metadata.pac.log.deo.trigger.path[0]}}'
'@metadata.pac.log.deo.trigger.path[0]'
'@metadata.pac.log.deo.trigger.path[0]'
'{{{_source.metadata.pac.log.deo.trigger.path[0]}}}'
'{{{_ingest.metadata.pac.log.deo.trigger.path[0]}}}'

由于其接收处理器不过滤插件，因此过滤器“ruby”不可用。可用接收处理器列表：

"processors": [
      {
        "type": "append"
      },
      {
        "type": "attachment"
      },
      {
        "type": "bytes"
      },
      {
        "type": "circle"
      },
      {
        "type": "community_id"
      },
      {
        "type": "convert"
      },
      {
        "type": "csv"
      },
      {
        "type": "date"
      },
      {
        "type": "date_index_name"
      },
      {
        "type": "dissect"
      },
      {
        "type": "dot_expander"
      },
      {
        "type": "drop"
      },
      {
        "type": "enrich"
      },
      {
        "type": "fail"
      },
      {
        "type": "fingerprint"
      },
      {
        "type": "foreach"
      },
      {
        "type": "geoip"
      },
      {
        "type": "grok"
      },
      {
        "type": "gsub"
      },
      {
        "type": "html_strip"
      },
      {
        "type": "inference"
      },
      {
        "type": "join"
      },
      {
        "type": "json"
      },
      {
        "type": "kv"
      },
      {
        "type": "lowercase"
      },
      {
        "type": "network_direction"
      },
      {
        "type": "pipeline"
      },
      {
        "type": "registered_domain"
      },
      {
        "type": "remove"
      },
      {
        "type": "rename"
      },
      {
        "type": "script"
      },
      {
        "type": "set"
      },
      {
        "type": "set_security_user"
      },
      {
        "type": "sort"
      },
      {
        "type": "split"
      },
      {
        "type": "trim"
      },
      {
        "type": "uppercase"
      },
      {
        "type": "uri_parts"
      },
      {
        "type": "urldecode"
      },
      {
        "type": "user_agent"
      }