Getting location out of a json field

So i have filters

  • source => certificate : which contains a JSON object.

Down in this certificate I have a SignatoryLocation. I'm trying to take that SignatoryLocation and add it as a field (so I can use it in a geoip-filter after that):

json {
source => "certificate"
add_field => { "location" : "%{SignatoryLocation}" }
geoip {
database => "C:\some\path\to\GeoLite2-City.mmdb"
source => "location"

This is kind of the path to the SignatoryLocation:


What kind of pathing do I use to get to this SignatoryLocation?

See for the notation used to access nested fields.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.