Extract fields from a json substring

Elastic Stack Logstash
1

I'm fairly new to Logstash filtering stuff. I've below json string

{
    "changed": false, 
    "msg": "Foo Facts: oma_phase: prd, oma_app: fsd, oma_apptype: obe, oma_componenttype: oltp, oma_componentname: -, oma_peak: pk99, oma_phaselevel: prd"
}

I would like to extract the fields oma_phase, oma_app, oma_apptype, oma_componenttype, oma_componentname, oma_peak & oma_phaselevel .

I've tried below native json filter,

filter {
  if [type] == "ansible" {
    json {
      source => "ansible_result"
    }
  }
}

Here ansible_result is the key holding the above json value. However, there are many keys having different values but with the same ansible_result key. This is creating lot of index keys and I don't want that.

I would like to have some sort of filter which can match the substring Foo Facts and there after extracting the oma_* fields.

I somehow couldn't managed to do with grok filter to match the substring. It would be really great if you could help me with this.

Many thanks in advance..

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.