Array values into single field

Elastic Stack Logstash
1

Hello,

I struggle to extract IPs from JSON, I need to extract all IPs from array/s(regardless of count) into one field.
Below the part of JSON I want to extract data from:

"source": {
        "explicit": {
          "included": [
            {
              "entry": {
                "ip": "10.21.64.0/23"
              }
            },
            {
              "entry": {
                "ip": "10.21.66.0/23"
              }
            },
            {
              "entry": {
                "ip": "10.21.68.0/23"
              }
            },
            {
              "entry": {
                "ip": "10.21.70.0/23"
              }
            },
            {
              "entry": {
                "ip": "10.21.72.0/23"
              }
            },
            {
              "entry": {
                "ip": "10.21.74.0/23"
              }
            },
            {
              "entry": {
                "ip": "10.21.76.0/23"
              }
            }
          ],

I tried
"Sources" => "%{[source][explicit][included]}"
"Sources1" => "%{[source][explicit][included][entry][ip]}"

And similar alternatives, with no success, field always show exact content array - including brackets, and "entry", "ips", colon...

I only need IP addresses divided by comma.

Thank you in advance
Stefan

2

See here.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.