Define logstash's jdbc-input-plugin json message root object

[endersonmaia]

I'm using jdbc-input-plugin to get some orders data and send it to a rabbitmq queue.

To make the json message compatible with the queue consuming system, I need to add a root named order.

I'm getting

{ "id" : 123, "price" : 12.50 }

and I need it to be

{ "order" : { "id" : 123, "price" : 12.50 } }

Is there any way I can inform the jdbc-input to use order as the default root for the message ?

[endersonmaia]

I know I can achieve this with mutate filter like :

filter {
  mutate {
    add_field => {
      "[order][id]"     => "%{[id]}"
      "[order][price]"  => "%{[price]}"
    }

    remove_field => [ "id", "price" ]
  }
}

But I hope there's a better way

[guyboertje]

No other way that I know of.

FYI. You can use add_field on the jdbc_input - it will run that function after the event is created.
If you have any other filter, just add the remove_field piece in it before the event hits the output section.