Filebeat with JSON, set root key

Elastic Stack Beats
1

Hi,

If you parse a JSON with filebeat and send it in elasticsearch, all root keys from the original json document will have the prefix json.<fieldname>. For example

{"status":400}  -> {"json" : { "status" : 400}}

Right?

So can we change this json name to something of our own liking or should we rewrite everything using logstash/ingest. (for example {"webservername":{"status":400}})

2

Hi,

Currently there is no way to do it, you can only choose to write it under the json key or directly under root with json.keys_under_root: true.

In the upcoming 6.3 release we add a new rename processor that can be used to rename fields in any way.

3

Ok thnx!

1 Like
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.