Extract fields from a json substring

I'm fairly new to Logstash filtering stuff. I've below json string

    "changed": false, 
    "msg": "Foo Facts: oma_phase: prd, oma_app: fsd, oma_apptype: obe, oma_componenttype: oltp, oma_componentname: -, oma_peak: pk99, oma_phaselevel: prd"

I would like to extract the fields oma_phase, oma_app, oma_apptype, oma_componenttype, oma_componentname, oma_peak & oma_phaselevel .

I've tried below native json filter,

filter {
  if [type] == "ansible" {
    json {
      source => "ansible_result"

Here ansible_result is the key holding the above json value. However, there are many keys having different values but with the same ansible_result key. This is creating lot of index keys and I don't want that.

I would like to have some sort of filter which can match the substring Foo Facts and there after extracting the oma_* fields.

I somehow couldn't managed to do with grok filter to match the substring. It would be really great if you could help me with this.

Many thanks in advance..

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.