I am trying to extract the following json to elasticsearch using logstash
{
"times_submitted": 6,
"name": "task1",
"sub_names": ["rescan", "that.doc", "c:\sorted\files\file1.exe"],
"tree": { "child1" : "abc",
"child2": {
grandchild1: "def",
grandchild2: "ghi"
}
}
}
I have created a template for this json in elasticsearch. I am able to capture all of the fields from this json except for "sub_names". The format of its contents in elasticsearch shows up as
"sub_names": """rescan,that.doc,c:\sorted\files\file1.exe"""
How do i carry over the sub_name field as an array to elasticsearch ?
How do i capture the tree fields into elasticsearch?
In my logstash filter i have the following
filter {
json {
source => "message"
target => "message"
}
json {
source => "[message][tree]"
target => "[message][tree]"
}
mutate {
add_field {
"[task][times_submitted]" => "%{[message][times_submitted]}"
"[task][name]" => "%{[message][name]}"
"[task][sub_names]" => "%{[message][sub_names]}"
"[task][tree]" => "%{[message][tree]}"
}
}
}
Thanks for helping.