Field named "tags" in logstash event causing problem

Elastic Stack Logstash
1

Hi,

Here is what my configuration looks like ...
filter {
mutate {
rename => {
"keywords" => "[tags][keywords]"
}
}
}

Essentially, I'm looking to mutate into a nested JSON under field named "tags".
Now this is leading a very weird result as follows:
"tags" => [
[0] [
[0] "keywords",
[1] "process, new, variable"
]
],
I'm guessing this could be cos perhaps logstash treats "tags" as a special keyword. In which case, how do I achieve what I want to ... have a nested JSON under "tags" field?

2

Any thoughts anyone?

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.