Extract field from json to the top-level

Elastic Stack Logstash
1

I have a json with the dynamic field, something like that:
{ field1: "value1", dynamicField: { innerField1: "...", innerField2: "...", ... } }
How can I extract all contents from dynamicField to the top level of message?

2

You'll have to use a ruby filter for this. I'm pretty sure examples have been posted in the past, either here or on Stackoverflow.

3

Yes, it can be achieved with the ruby filter, thatnks.
Here it it is the config, if someone curious:

filter { ruby {
code => "
  begin
    dynamicField= event.get('dynamicField')
    if dynamicField!= NIL
      dynamicField.keys.each{|key|
        event.set(key, dynamicField[key])
      }
      event.remove('dynamicField')
    end
  end
" }}
1 Like
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.