Help with logstash config

Thanks a lot! That helped.

I have another issue now, so for case where there is a json message inside a json message

The fields get split as
ctx.tid,
ctx.username
v.query-category
v.query-hash

and so on...

If i have to update any of the field or remove any of the field if i use ctx.tid or ctx.username it does now work

could you please help me with how to work with fields which are json within a json