Add the field value to each new filed after json filter processing in Logstash

Elastic Stack Logstash
1

Hi There,

I am trying to configure my logstash to add the parent field name to all the fileds of the child (to make it understand where the filed actually came from)

Ex: I am having the below as the incoming data in a url

{
  "RequestData": { "Title": "Mr","Gender": "M","FirstName": "UAT","MiddleName": "","LastName": "T","DOB": "08071969","EmailAddress": "UAT1212@im.com","COR": "IN","CitizenOf": "IN" },
  "ResponseData": { "ResponseStatus": { "Flag": false, "Code": 0, "Message": "Bad Request", "Description": "Error validating JSON. Error: - Missing required field \"ExtAuthCode\""}}
}

When using json filter as below;

json { source => "RequestData" }
json { source => "ResponseData" }

In kibana i see the data as;

"Title": "Mr",
"Gender": "M",
"FirstName": "UAT",
"MiddleName": "",
"LastName": "T",
"DOB": "08071969",
"EmailAddress": "UAT1212@im.com",
"COR": "IN",
"CitizenOf": "IN"
"ResponseStatus": {
  "Flag": false,
  "Code": 0,
  "Message": "Bad Request",
  "Description": "Error validating JSON. Error: - Missing required field \"ExtAuthCode\""
}

What i actually intend to see is;

"RequestData.Title": "Mr",
"RequestData.Gender": "M",
"RequestData.FirstName": "UAT",
"RequestData.MiddleName": "",
"RequestData.LastName": "T",
"RequestData.DOB": "08071969",
"RequestData.EmailAddress": "UAT1212@im.com",
"RequestData.COR": "IN",
"RequestData.CitizenOf": "IN"

Any solution for this requirement please?

Regards

Kaushik

2

Use the target option of the json filter.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.