Generating events from JSON array inside root-level object

Use a split filter

    mutate { remove_field => [ "messages" ] }
    split { field => "datapoints" }

You can move the fields to the root level using How to dynamically move nested key value to root level.

1 Like