Best way to set a field value to be a (json) object?

[jdmcalee (Justin McAleer)]

I'm trying to configure a logstash filter to add a field that contains one of more objects. In other words, I want the document json for the field to end up looking something like this:

{"links":[{"label":"google","url":"https://google.com"}]}

I have that working by having one filter add a field with the value set to a json string that's defined directly in the config, coupled with an instance of the json filter to expand that back into a data structure:

mutate {
    add_field => { "linksJson" => '{"links":[{"label":"google","url":"https://google.com"}]}' }
}
json {
    source => "linksJson"
}

It seems like there must be a better way of doing this; I don't like manually doing json encoding like this. The url value will be pulled out of the event data in the real config, so it would be susceptible to breaking, for one thing. Can anyone straighten me out?

[Badger]

You're showing us the data you don't want to transform and asking us to help you transform data you haven't shown us. I'm not willing to guess

[jdmcalee (Justin McAleer)]

By simplifying my config down, I must have ironically made things less clear. I was trying to avoid transforming anything at all; I'm adding a new field that I want to contain an object. In any event, this morning I finally searched for the right terms and came across a post here that got me to an acceptable solution.

It's not quite what I started out toward, but it's good enough. I'm not sure arrays of nested objects are a good idea anyway, even if possible. For posterity, to end up with a field called links that is an object/hash of label => url (what the keys and values represent in this example), this works:

mutate {
    add_field => { "[links][google]" => "https://google.com" }
    add_field => { "[links][api]" => "/api" }
}