Dissect json fields in a specific field

Elastic Stack Logstash
1

Hi,

I would like to know if it is possible to use the json parser to add thes fields result in a chosen field
instead of just in the "_source" field.

for example:
message = "{'step': 1, 'completed': true}"

filter{
   mutate: {
        add_field: "json_result" => { json :{ source => "message"}}
   }
}

??

2

Solved it with the target tool of json filter plugin

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.