I am importing into Elastic.
My log file looks like this:
{"Transmission":{"Value":"{ "Users": [{"ArtifactID": 123123}] }"}}
I am having difficulty getting the json value out of Users as an array so that it can be formatted like this in Elastic:
"TransmissionJson" => {
"Users" => [
[0] {
"ArtifactID" => 123123
}
]
}
Unfortunately when I parse this with logstash, the Users value gets flattened and is no longer an array:
"Users" => "{"ArtifactID"=>123123}"
Any suggestions? Thanks!
My config looks like this:
input {
file {
path => [ "C:/MetricsLogs/**/*.log" ]
start_position => "beginning"
codec => "json"
}
}
filter {
mutate {
add_field => { "source" => "%{[TransmissionJson]}" }
}
json {
source => "source"
remove_field => "source"
}
grok {
match => { "[Value]" => "%{GREEDYDATA:workspaceJson}" }
}
json {
source => "workspaceJson"
target => "parsedJson"
remove_field => "workspaceJson"
}
mutate {
add_field => { "Users" => "%{[parsedJson][Users]}"}
}
}
output {
stdout { codec => rubydebug }
}