Access json fields from string

I have a valid string within my initial message.

I extract this string in a variable "payload" and remove the end of the string which is not part of the json.
At this point, my string is a valid JSON.

                            mutate {
				gsub => [
					"payload", "end_of_string", ""

I need to access fields values (also be able to fetch a whole object) and put these in other fields.

For example:

"first": "one",
"second": {
"number": "1",
"letter": "a"

How can I access the value "one", and how can I take the whole second object into another json field? No string manipulations.

Also, is it possible to pretty print it?

Use a json filter to parse the JSON string in the payload field into discrete Logstash fields. If you want to turn the resulting event back into JSON I think the json_encode filter will be helpful.

Also, is it possible to pretty print it?

Pretty print where?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.