Conditional is not working to find nested JSON field

Elastic Stack Logstash
1

Hi, I used logstash filter to avoid mapper-parsing-exception in this case.

  • JSON Data
    {"request_body":{
    "enveloped_message":{"X":"x", "Y":"y"}
    }
    OR
    {"request_body":"ABC"}

  • logstash filter config
    if "enveloped_message" in [request_body] {
    mutate {
    rename => { "request_body" => "request_body_json" }
    }
    }

  • result
    request_body : ABC
    request_body_json.enveloped_message.X : x
    request_body_json.enveloped_message.Y : y

  • Problem
    conditional can't found enveloped_message!
    so rename is not working, mapping conflict error in request_body

It was work in 6.1.2 logstash, but now is'nt work after upgrade to logstash 7.2.0

Why is not working?? I can't found in upgrade note what difference in conditional
How to find if field have injesting field?

Plz, I need your help. T_T

Thank you.

2

You can use "in" for array membership, or for substring matching against a string, but I don't think you can use it to test whether a field exists in an object. Try

if [request_body][enveloped_message] {
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.