Dynamic JSON parsing

Elastic Stack Logstash
1

I'm trying to change a document from this. Is this possible?

{
"zenoss01.hostname": {
"issued_to": null,
"cert_sans": "",
"valid_till": "2021-01-17",
"valid_from": "2016-01-18",
"issuer_ou": null,
"days_left": 364,
"cert_ver": 2,
"cert_alg": "sha256WithRSAEncryption",
"issued_o": "Zenoss",
"cert_exp": false,
"cert_sha1": "83:E4:4B:8B:DF:E4:72:78:A3:7B:24:99:96:1D:6A:C6:ED:67:A5:8E",
"issuer_c": "US",
"issuer_cn": null,
"issuer_o": "Zenoss",
"validity_days": 1826,
"cert_sn": "15935028744769600013"
}
}

To this.

{
"hostname": "zenoss01.hostname"
"issued_to": null,
"cert_sans": "",
"valid_till": "2021-01-17",
"valid_from": "2016-01-18",
"issuer_ou": null,
"days_left": 364,
"cert_ver": 2,
"cert_alg": "sha256WithRSAEncryption",
"issued_o": "Zenoss",
"cert_exp": false,
"cert_sha1": "83:E4:4B:8B:DF:E4:72:78:A3:7B:24:99:96:1D:6A:C6:ED:67:A5:8E",
"issuer_c": "US",
"issuer_cn": null,
"issuer_o": "Zenoss",
"validity_days": 1826,
"cert_sn": "15935028744769600013"
}

2

You can move fields to the top level using something like this.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.