Does logstash support having a list/array in root (top level) of the event

Elastic Stack Logstash
1

We have input data like this message:[{key1:value1},{key2:value2}]
and we need value of message, which is a list, directly on root of event (to use as zipkin storage) without any additional field.
I tried using json filter,

filter {
  if [type] == "tracing" {
    json {
      source => "message"
      skip_on_invalid_json => true
      remove_field => [ "message" ]
    }
 }
}

output {
  if [type] == "tracing" {
    elasticsearch {
      hosts => ["${ELASTIC_HOST}"]
      index => "tracing-%{+YYYY.MM.dd}"
    }
  }
}

Here without target, which ideally should move value of message to root of event, but I get error Parsed JSON object/hash requires a target configuration option

2

Your JSON is an array. logstash is telling you that the array has to have a name.

What do you want to event to look like?

3

Expected event format

[{key1:value1},{key2:value2}]

Basically zipkin wanted to consume it from elasticsearch and list is what it requires.
Here is a similar discussion - Logstash Filter Json To Array of Json - #6 by Badger but in my case output is elasticsearch I don't think I can use codec => plain { format => "[ %{[@metadata][string]}

4

You cannot have an array at the top level of an event.

5

Thanks @Badger we will see some other alternatives

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.