Extract field from json to the top-level


I have a json with the dynamic field, something like that:
{ field1: "value1", dynamicField: { innerField1: "...", innerField2: "...", ... } }
How can I extract all contents from dynamicField to the top level of message?

(Magnus B├Ąck) #2

You'll have to use a ruby filter for this. I'm pretty sure examples have been posted in the past, either here or on Stackoverflow.


Yes, it can be achieved with the ruby filter, thatnks.
Here it it is the config, if someone curious:

filter { ruby {
code => "
    dynamicField= event.get('dynamicField')
    if dynamicField!= NIL
        event.set(key, dynamicField[key])
" }}

(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.