Dissect json fields in a specific field


I would like to know if it is possible to use the json parser to add thes fields result in a chosen field
instead of just in the "_source" field.

for example:
message = "{'step': 1, 'completed': true}"

   mutate: {
        add_field: "json_result" => { json :{ source => "message"}}


Solved it with the target tool of json filter plugin

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.