Filter embedded JSON


My logs have embedded escaped JSON in one of its input JSON fields:

"log": "{"timestamp":"2016-06-02T07:49:05.850+00:00","message":"Stopping beans in phase 0","level":"INFO"}",
"stream": "stdout",
"time": "2016-06-02T07:49:05.858092736Z"

Now I would like to configure a filter that creates the JSON attributes in the escaped "log" value in my output:

"timestamp": "2016-06-02T07:49:05.850+00:00",
"message": "Stopping beans in phase 0"
"level" : "info"

How can I do this?


Use a json filter with source => "log" or a json codec for the input plugin you use.