Getting location out of a json field

So i have filters

  • source => certificate : which contains a JSON object.

Down in this certificate I have a SignatoryLocation. I'm trying to take that SignatoryLocation and add it as a field (so I can use it in a geoip-filter after that):

json {
source => "certificate"
add_field => { "location" : "%{SignatoryLocation}" }
}
geoip {
database => "C:\some\path\to\GeoLite2-City.mmdb"
source => "location"
}

This is kind of the path to the SignatoryLocation:

certificate\field\another\anotherYet\Signatory\SignatoryLocation

What kind of pathing do I use to get to this SignatoryLocation?

See https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#logstash-config-field-references for the notation used to access nested fields.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.