Format json

Hi all, i have a log in json format:


And I want to transform in this:
name: data1
notification: 0

The porpouse is see this in kibana.
Thanks in advance.

I suspect you won't be able to use the json or json_lines codecs since it's an array, but you can use a json filter to deserialize the JSON string. Then use a mutate filter to rename (move) the fields into the top level of the event.

thanks magnus, but i want a way to transform this log by with out using the names of each json value, there is a way to do that?, the reason is that i have to many differents json formats in my logs, for example

And many other variations, is posible to use a general filter that apply to all this logs? Or I have to use a differente filter to each one.

You can use a ruby filter to copy/move fields with dynamic names. Examples of how to do that have been posted here in the past.

Magnus could you giveme an example please? or some criteria to search, I try to find examples, but with out luck.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.