Filebeat JSON Parsing

I am trying to ingest below JSON to elastic through filebeat http json input plugin.

"metricId": 185016812,
"metricName": "BTM|Application Diagnostic Data|Base Page:20869077|Synthetic Visually Complete Time (ms)",
"metricPath": "End User Experience|Base Pages||Synthetic Visually Complete Time (ms)",
"frequency": "ONE_MIN",
"metricValues": [
"startTimeInMillis": 1682654100000,
"occurrences": 0,
"current": 119,
"min": 0,
"max": 432,
"useRange": true,
"count": 4,
"sum": 1062,
"value": 266,
"standardDeviation": 0

Not the problem is I want to seperate the metric path and metric name itself so that I can get the seggregated values inside elastic. Please tell me how can I do that



  • type: httpjson
    enabled: true
    id: CP_M2O_Channel_Management
    interval: 1m
    auth.basic.user: ""
    auth.basic.password: ""
    request.method: GET

    • set:
      target: header.Content-Type
      value: "application/vnd.appd.cntrl+protobuf;v=1"

    response.decode_as: application/json
    response.save_first_response: true
    target: body.metricName
    type: array

    keep_parent: true

    • decode_json_fields:
      fields: ["message"]
      target: metricValues

The dissect processor could probably do the trick.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.