Decode Array and Extract

Elastic Stack Beats
1

Hi to All,
last few weeks I am getting up to speed with Filebeat and ES, experience is up to now great!!
Currently i believe that i am stuck with a small issue: Namely, if i decode array from json, is it possible to extract the array as per XXXXX

in my Configuration file i have

`processors:
  • decode_json_fields:
    fields: ["wlan_addr"]
    process_array: true
    overwrite_keys: false
    add_error_key: true
  • extract_array:
    field: "wlan_addr"
    mappings:
    source.ip: 0
    destination.ip: 1
    network.transport: 2`
    but the array is not extracted at.
    Is it possible to firstly decode JSON and than to extract the array elements? If yes any help would be more than welcome!!

P.s.Logstash is unfortunatelly not an option
Cheers
MB

2

hi @Milos, can you provide us with an example of the message you are trying to run the processes against in order to get a better understanding on the goal?

3

Hi Mariana,
silly me i forgot the most important part:

{"timestamp" : "1599380552945", "layers" : {"wlan_addr": ["f8:1f:38:f1:10:f5","f1:b2:13:54:8a:75","f2:b1:12:51:8c:43"]}}

The Json is rather simple but I am unfortunately not experienced enough in Filebeat to pin point it

Thanks in Advance!
MB