Enclose log-stash output in json array [ ]

Elastic Stack Logstash
1

Hi,
I am in need of sending json on following format (note [ ] at top level) :
[ { "some_field" : "some_value"} ]
however what logstash file output logs following:
{ "some_field" : "some_value"}

When I try to to use mutate replace filter and enclose my message in "[ ] "
replace => { "message" => '[ { "some_field" : "some_value"} ]' }
}
I got from json filter:

Trouble parsing json {:source=>"message", :raw=>"[ { "some_field" : "some_value"} ]", :exception=>#<TypeError: can't convert Java::JavaUtil::ArrayList into Hash>, :level=>:warn}

How can I enclose output json into json array "[ ]" ?

2

Oddly enough, I need exactly the same thing as mozowski. I require this format

[{"message":"some informational content"}]

When sending to a RabbitMQ exchange, but I can't get it right either to RabbitMQ or even to a plain stdout or file output. I can wrap one value in [] but not the whole thing which is what I need to do.

I have tried a wide variety of mutate and etc. but I must be missing something. (I am a logstash newbie.)

3

Just in case it may help you, mozowski, depending on how desperate you get:

I made a temporary workaround by hacking the distributed march_hare.rb to rewrite the message (adding the square brackets) immediately before it is published to RabbitMQ. (You'd have to do the same for whichever output you are using, which I don't think you specified.)

This is just a hack, and I suppose if I don't find a better answer I'll write my own output plugin that's just a modified copy of one of the distributed ones.

It does seem odd to have to go that route, however.