Grok array of jsons

Elastic Stack Logstash
1

how do I grok array of jsons
eg:
[2017-05-29 02:17:18] INFO – [ActivityServiceRest:89] – [{“callId”:”kjwefkjweqkfb”},{“callId”:”nwekgwnkqgkqr”},{“callId”:”ohjiwnwbnwbrk”}]

I want to store all the callId's in a field called call_Id
where number of times callId appears is dynamic
Can someone please help.

2

Use a grok filter to extract the various pieces of the string into discrete fields. What's most important for your current question is that the JSON array is in a field of its own. Then have a json filter process that field, and finally you'll have to write a small piece of Ruby in a ruby filter to collect all the call id values into an array. This probably works:

ruby {
  code => "event.set('call_Id', event.get('XXX').collect { |h| h['callId'] })"
}

Replace XXX with the name of the field containing the parsed JSON array.

3

Thanks a lot, it worked and I am able to get callId's in an array but it's giving me _dataparsefailure in the tags. Is it something related to Json field in the input log?

4

The Logstash log will contain details about the date filter's failure. You also need to post your Logstash configuration.

5

Yeah, there was an error in my logstash filter and I resolved it. Thanks for helping out

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.