Getting multiple fields out of agent

Elastic Stack Logstash
1

still new and learning filters... how would I get multiple fields out of agent?

"agent" => {
"hostname" => "2487b31167e2",
 "name" => "123b456c",
"ephemeral_id" => "123b456c",
"version" => "7.15.1",
   "id" => "123b456c",
 "type" => "filebeat"
},
2

What do you mean by that?

3

as an example:

if I wanted to get

 "hostname => 2487b31167e2"
"ephemeral_id" => "123b456c",
"version" => "7.15.1",

would I have to do:

"agent" => "[agent][version]"
"agent" => "[ephemeral][id]"
"agent" => "[hostname]"

the json is nested within agent portion

4

To get multiple fields out of "agent" now that I've solved the issue is using the "add field" function.
this can be found in documentation and a good example I fell on was this video: How to use Logstash to parse and import JSON data into Elasticsearch - YouTube

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.