Solved.
filter {
json {
source => "message"
target => "json"
}
if "_jsonparsefailure" not in [tags] {
ruby {
code => "
json_data = event.get('[json]')
event.set('url', json_data.keys[0])
event.set('parameters', json_data[json_data.keys[0]])
"
}
mutate {
remove_field => ["message"]
remove_field => ["json"]
}
}
}
This can help.