Access json fields from string

[zuokuok]

I have a valid string within my initial message.

I extract this string in a variable "payload" and remove the end of the string which is not part of the json.
At this point, my string is a valid JSON.

                            mutate {
				gsub => [
					"payload", "end_of_string", ""
				]			
			}

I need to access fields values (also be able to fetch a whole object) and put these in other fields.

For example:

{
"first": "one",
"second": {
"number": "1",
"letter": "a"
}
}

How can I access the value "one", and how can I take the whole second object into another json field? No string manipulations.

Also, is it possible to pretty print it?

[magnusbaeck (Magnus Bäck)]

Use a json filter to parse the JSON string in the payload field into discrete Logstash fields. If you want to turn the resulting event back into JSON I think the json_encode filter will be helpful.

Also, is it possible to pretty print it?

Pretty print where?