Fields are not populating from logstash to elastic

Elastic Stack Logstash
1

I am using logstash to populate elastic
I have it set so this filter:

filter {
  json {
    source => "message"
    target => "jsoncontent"
    remove_field => ["message"]
    }
}

and

jsoncontent: {"switchname": "switch1", "interface": "Ethernet101/1/5", "vlan": "25", "speed": "a-1000", "duplex": "full"}```
type or paste code here

to populate elastic
However the only field I get is jsoncontent. I want fields created for switchname, interface, vlan, speed, duplex

Any idea how I can create those fields?

2

The [jsoncontent] field is created by the json filter. There will be fields within like [jsoncontent][switchname]. If you want those at the top level then remove the target option from the json filter.

3

when I remove the top filter I get a json error in my output saying that a target is needed
Parsed JSON object/hash requires a target configuration option {:source=>"message",

4

OK, so check this thread.

5

sorry I am confused, how does the ruby code help?

6

I see how it could help but my code is not working
did I do something wrong on it:

filter {
  json {
    source => "message"
    target => "jsoncontent"
    remove_field => ["message"]
    }
}

ruby {
  code => '
    event.get("jsoncontent").each { |k, v|
    event.set(k,v)}
    event.remove("jsoncontent")'
}
7

What do you see if you use output { stdout { codec => rubydebug } } ?

8

For some reason with the ruby code the conf file will not launch, so I cannot get a stdout

9

So remove the ruby filter and post the rubydebug.

10

sorry for the delay:

          "event" => {
        "original" => "\"{\\\"switchname\\\": \\\"switch1\\\", \\\"interface\\\": \\\"Ethernet101/1/2\\\", \\\"vlan\\\": \\\"254\\\", \\\"speed\\\": \\\"a-1000\\\", \\\"duplex\\\": \\\"full\\\"}\""
    },
    "jsoncontent" => "{\"switchname\": \"switch1\", \"interface\": \"Ethernet101/1/2\", \"vlan\": \"254\", \"speed\": \"a-1000\", \"duplex\": \"full\"}",
       "@version" => "1",
     "@timestamp" => 2023-12-05T21:17:44.717761918Z,
           "host" => {
        "ip" => "5.5.5.5"
    }
}
11

OK, you will need to use a second json filter to parse [jsoncontent].

12

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.