Extract field's from a message field

Elastic Stack Logstash
1

I'm colleting logs from a file .log:

{"type":"audit_entry","created":"5/20/2021, 11:12:42 PM","colaborador_id":"cf7dc62b-dde9-4980-89d8-96eb5707876e","request_method":"PUT","ajax":false,"route":"/stock/artigos/8c443bfe-d077-46d2-805b-948c15534f2c","protocol":"https"}

But I don't know how to catch all these fields. I put them in the elasticsearch and the JSON file is:

{
  "_index": "prod",
  "_type": "_doc",
  "_id": "8pWIpHkBSNn6S0YNSeBX",
  "_score": 1,
  "_source": {
"@version": "1",
"log": {
  "file": {
    "path": "/usr/share/prod/action.log"
  },
  "offset": 380990
},
"ecs": {
  "version": "1.6.0"
},
"agent": {
  "name": "ee0ccbef92f1",
  "type": "filebeat",
  "version": "7.11.0",
  "hostname": "ee0ccbef92f1",
  "ephemeral_id": "29f3e0e3-13be-40ac-abd9-35b688a5a177",
  "id": "5967388f-6559-4b97-87c7-79bb3b1a2179"
},
"message": "{\"type\":\"audit_entry\",\"created\":\"5/25/2021, 5:17:40 PM\",\"colaborador_id\":\"af4a57b5-c05f-446a-be65-97143d4629a5\",\"ip\":\"192.168.112.6\",\"request_method\":\"PUT\",\"ajax\":false,\"route\":\"/relacionamento/agendamento/c8492b33-4167-4466-abdd-d6729e38df2f\",\"protocol\":\"https\"}",
"tags": [
  "beats_input_codec_plain_applied"
],
"@timestamp": "2021-05-25T17:17:42.678Z",
"input": {
  "type": "log"
},
"host": {
  "name": "ee0ccbef92f1"
}
  },
  "fields": {
"@timestamp": [
  "2021-05-25T17:17:42.678Z"
]
  }
}

How I can structure the message field to catch all the fields is in the message?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.