Help with parsing JSON file

[JohnD76 (John)]

Hi,

I am still learning how to use Logstash and need some assistance in how to reference fields inside a field and also inside an array please.

Using the example below, how do I reference the MONITORING.responseStatus and the MONITORING.Events.ChildIds and get this into a new field within the top level of the document?

I have been working on this for some time and keep going round in circles so would appreciate a little help please:

{
"@version" => "1",
"@timestamp" => 2018-06-14T19:55:14.426Z,
"doc" => {
"message" => "",
"timestamp" => "2018-06-12T15:47:45.306Z",
"level" => "info",
"MONITORING" => {
"ResponseText" => "",
"ResponseStatus" => "OK",
"Timestamp" => "2018-06-12T15:47:45.306Z",
"MessageHeaderId" => "5940475.00000.PL01180612000000F",
"Events" => [
[0] {
"ParentId" => "urn:epc:id:sgtin:74018FM162900001500",
"ChildCount" => 25,
"EventTimestamp" => "2018-06-12T16:29:44.510+02:00",
"InvoiceReference" => "",
"ChildIds" => [
[ 0] "urn:epc:id:sgtin:74018FM162900025300",
[ 1] "urn:epc:id:sgtin:74018FM162900026300",
[ 2] "urn:epc:id:sgtin:74018FM162900027300",

[magnusbaeck (Magnus Bäck)]

https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#logstash-config-field-references

So e.g. [MONITORING][responseStatus]. If you tell us exactly what result you're looking for someone might be able to make a concrete suggestion.