Format json

(Jose ) #1

Hi all, i have a log in json format:


And I want to transform in this:
name: data1
notification: 0

The porpouse is see this in kibana.
Thanks in advance.

(Magnus Bäck) #2

I suspect you won't be able to use the json or json_lines codecs since it's an array, but you can use a json filter to deserialize the JSON string. Then use a mutate filter to rename (move) the fields into the top level of the event.

(Jose ) #3

thanks magnus, but i want a way to transform this log by with out using the names of each json value, there is a way to do that?, the reason is that i have to many differents json formats in my logs, for example

And many other variations, is posible to use a general filter that apply to all this logs? Or I have to use a differente filter to each one.

(Magnus Bäck) #4

You can use a ruby filter to copy/move fields with dynamic names. Examples of how to do that have been posted here in the past.

(Jose ) #5

Magnus could you giveme an example please? or some criteria to search, I try to find examples, but with out luck.

(system) #6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.