Hello,
I'm trying to extract some field/value pairs from a single field in a json string. My sample message:
{
...
"comment":"Ticket number : INC:I16393898, status : Work In Progress, group : Ent.Support.SOC.",
...
}
From the value of the "comment" field I would like to extract three separate field/value pairs:
"Ticket number":"INC:I16393898"
"status":"Work In Progress"
"group":"Ent.Support.SOC."
What I tried and miserably failed:
filter {
mutate {
add_field => { "cmt_ticket_no" => "%{[comment][Ticket number]}" }
add_field => { "cmt_status" => "%{[comment][status]}" }
add_field => { "cmt_group" => "%{[comment][group]}" }
}}
Is there a solution for what I try to achieve? Any suggestion is highly appreciated. Thanks.