How can I remove dot from nested object in logstash

Elastic Stack Logstash
1

what goes to elasticsearch is something like this:

  {
    "result": "https://www.yahoo.com",
    "tags": {
      "url": "https://www.yahoo.com",
      "projectName": "monitor",
      "host": "ttt",
      "dd": 12345,
      "vv": "kk"
    },
    "timestamp": 1586599441000,
    "runId": 12345,
    "performance": {
      "x.y.z": 31307
    
    },
    "channel": "clientperf",
    "asset": {
      "a.b.c": 5,
     "a.b":4
    }
  }

as you see values inside asset and performance has dot and we don't have access to the original source to change. Also as you can see we can have both values a.b.c and a.b which makes problem in mapping. How can I resolve this either with replacing the dot in logstash or anything that doesn't give me error Object mapping for [x] tried to parse field [x.y] as object, but found a concrete value

2

You could use mutate+rename to rename those fields so that they do not contain periods.

3

@Badger The fields have dynamic naming and are nested. can you let me know how do you do that for the example that I provided? (the filter part of logstash config. )

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.