Filebeat JSON Parsing

Elastic Stack Beats
1

I am trying to ingest below JSON to elastic through filebeat http json input plugin.

[
{
"metricId": 185016812,
"metricName": "BTM|Application Diagnostic Data|Base Page:20869077|Synthetic Visually Complete Time (ms)",
"metricPath": "End User Experience|Base Pages|login.microsoftonline.com/1a407a2d-7675-4d17-8692-b3ac285306e4/login|Synthetic Visually Complete Time (ms)",
"frequency": "ONE_MIN",
"metricValues": [
{
"startTimeInMillis": 1682654100000,
"occurrences": 0,
"current": 119,
"min": 0,
"max": 432,
"useRange": true,
"count": 4,
"sum": 1062,
"value": 266,
"standardDeviation": 0
}
]
},

Not the problem is I want to seperate the metric path and metric name itself so that I can get the seggregated values inside elastic. Please tell me how can I do that

Configuration:

filebeat.inputs:

  • type: httpjson
    enabled: true
    id: CP_M2O_Channel_Management
    interval: 1m
    request.url:
    auth.basic.user: ""
    auth.basic.password: ""
    request.method: GET
    request.transforms:

    • set:
      target: header.Content-Type
      value: "application/vnd.appd.cntrl+protobuf;v=1"

    response.decode_as: application/json
    response.save_first_response: true
    response.split:
    target: body.metricName
    type: array

    keep_parent: true
    processors:

    • decode_json_fields:
      fields: ["message"]
      target: metricValues
2

The dissect processor could probably do the trick.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.