Decode_json on partial field

Elastic Stack Beats
1

Hi there,
I'm pulling in a log with filebeat with lines that look like this:

I, [2019-10-16T17:44:37.242758 #17339] INFO -- : [ac4878f8-b88b-406f-8271-f7efb873e200] {"method":"GET","path":"/healthcheck","format":"text","controller":"HealthCheck::HealthCheckController","action":"index","status":200,"duration":4.71,"view":0.14,"db":2.25,"params":{"action":"index"},"plan_name":null,"admin_id":null,"admin_name":null}

So there's some preamble prefixing a json object. What I'd like to do is use decode_json only on the json part of this field (in this case, the whole text comes in just in themessage field. Is there some way to break this up and run the json decode only on the json part?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.