Access information inside an object

Elastic Stack Logstash
1

i'm having trouble accessing data inside an object, this is the original input

{
"L4_DST_PORT" => 10082,
"IN_PKTS" => 4115,
"SRC_IP_LOCATION" => [
[0] -84.497803,
[1] 38.0462
],
"DST_IP_LOCATION" => [
[0] 0.0,
[1] 0.0
],
"L7_PROTO" => 87,
"json" => {
"MAX_TTL" => "40",
"RTP_OUT_MOS" => "440",
"SRC_TOS" => "184",
"ICMP_TYPE" => "0",
"RTP_MOS" => "440",
"MIN_TTL" => "40",
"RTP_OUT_JITTER" => "34",
"RTP_IN_MOS" => "440",
"57943" => "172.23.0.157",
"RTP_IN_JITTER" => "42"
},
"@timestamp" => 2018-03-14T14:21:06.141Z
}

i'm only interested on the fields inside the "json" object, however i don't know to access that information.

let's say i want to use the RTP_MOS and use it on the http output as a dynamic variable, how i can access that field???

thanks

2

You're probably looking for %{[json][RTP_IN_MOS]}.

3

seems very logical, however it dind't work.

i receive this error message:

JSON: The returned JSON does not match the expected structure ('%{[json). (code: PE231)RTP_IN_MOS]}' is not a valid integer value]

when i use other variable on the main message not inside "json" object it works perfectly, like
"%{L4_DST_PORT}" it works fine

is there any way to transform that object into a flat information, i mean extract all the information inside the "json" object

4

What does your configuration look like?

is there any way to transform that object into a flat information, i mean extract all the information inside the "json" object

You can move (rename) the fields with a mutate filter. If you don't have a fixed list of field names you can bulk-rename them with a ruby filter.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.