Filter mutate add_field : select a value in an inner field

Elastic Stack Logstash
1

I have a json input :

{"@version":"1","@timestamp":"2018-03-19T18:24:01.919Z","fields":"{\"numdocksavailable\":0,\"is_installed\":0,\"is_returning\":0,\"is_renting\":0,\"last_reported\":1519703208,\"station_id\":66505513,\"numbikesavailable\":0}"}
{"@version":"1","@timestamp":"2018-03-19T18:24:01.919Z","fields":"{\"numdocksavailable\":0,\"is_installed\":0,\"is_returning\":0,\"is_renting\":0,\"last_reported\":1519703208,\"station_id\":66505511,\"numbikesavailable\":0}"}
    ...

I want to add at root the field fields.station_id

The code bellow does not work:
filter { mutate { add_field => { "station_id" => "%{[fields][station_id]}"} } }

Actually it create a field station_id with value literrally without interpretion of value
"station_id":"%{[fields][station_id]}"

Please, could you help me to improve my selector?

2

Your fields field isn't an object with fields like station_id, it's a JSON string that needs to be parsed. Use a json filter for that.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.