So i have filters
- source => certificate : which contains a JSON object.
Down in this certificate I have a SignatoryLocation. I'm trying to take that SignatoryLocation and add it as a field (so I can use it in a geoip-filter after that):
json {
source => "certificate"
add_field => { "location" : "%{SignatoryLocation}" }
}
geoip {
database => "C:\some\path\to\GeoLite2-City.mmdb"
source => "location"
}
This is kind of the path to the SignatoryLocation:
certificate\field\another\anotherYet\Signatory\SignatoryLocation
What kind of pathing do I use to get to this SignatoryLocation?