Filter JSON Array Using Logstash

Elastic Stack Logstash
1

Hi guys, can anybody help me?
I have JSON Array as an input like this:

"reported_devices": [
                {
                    "id": "636e6930-6361-3a65-393a-36393a31643a", 
                    "ips": [
                        {
                            "address": "10.244.0.1", 
                            "version": "v4"
                        }, 
                        {
                            "address": "fe80::c8e9:69ff:fe1d:5d39", 
                            "version": "v6"
                        }
                    ], 
                    "mac": {
                        "address": "ca:e9:69:1d:5d:39"
                    }, 
                    "name": "cni0"
                }, 
                {
                    "id": "656e7333-3536-3a36-663a-66383a63363a", 
                    "ips": [
                        {
                            "address": "10.43.2.192", 
                            "version": "v4"
                        }, 
                        {
                            "address": "fe80::546f:f8ff:fec6:fd", 
                            "version": "v6"
                        }
                    ], 
                    "mac": {
                        "address": "56:6f:f8:c6:00:fd"
                    }, 
                    "name": "ens3"
                }, 
                {
                    "id": "666c616e-6e65-6c2e-3139-653a38653a65", 
                    "ips": [
                        {
                            "address": "10.244.0.0", 
                            "version": "v4"
                        }, 
                        {
                            "address": "fe80::9c8e:eaff:fe49:6000", 
                            "version": "v6"
                        }
                    ], 
                    "mac": {
                        "address": "9e:8e:ea:49:60:00"
                    }, 
                    "name": "flannel.1"
                }, 
                {
                    "id": "63616c69-3836-6430-3838-616337343365", 
                    "ips": [
                        {
                            "address": "fe80::ecee:eeff:feee:eeee", 
                            "version": "v6"
                        }
                    ], 
                    "mac": {
                        "address": "ee:ee:ee:ee:ee:ee"
                    }, 
                    "name": "cali86d088ac743"
                }, 
                {
                    "id": "63616c69-6231-3431-6432-653938656665", 
                    "ips": [
                        {
                            "address": "fe80::ecee:eeff:feee:eeee", 
                            "version": "v6"
                        }
                    ], 
                    "mac": {
                        "address": "ee:ee:ee:ee:ee:ee"
                    }, 
                    "name": "calib141d2e98ef"
                }
            ]

I want to filter the data and get only the data for "address": "10.43.2.192" and discard the others, how to do it?

2

Hey,

i'm going to make this as simple as possible, you know you can parse data with the JSON filter and then access it with something like %{[reported_devices][1][ips][0][address]}

What you have to use is a ruby code to iter through the json arrays and extract values like %{[reported_devices][xx][ips][0][address]} .

What is suggest to anyone working in JSON is to try to manipulate their files trough a JSON navigator ( like dropping it into firefox ) and actually see what's the structure of the data i'm using.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.