How create fields using json fileter in logstash

Elastic Stack Logstash
1

Hi
I am getting json formated data I can able to split the data into fields using json plugin in logstash,but with in the fields i am some more fields.Please help me out to get those fields also.
Below is the example for the field

  resource.instanceDetails.networkInterfaces	 {

"privateIpAddresses": [
{
"privateIpAddress": "xxxxxxx",
"privateDnsName": null
},
{
"privateIpAddress": "xxxxxxxxxxx",
"privateDnsName": ""
}
],
"ipv6Addresses": ,
"privateDnsName": null,
"privateIpAddress": "xxxxxxx",
"networkInterfaceId": "xxxxxxxxx",
"securityGroups": [
{
"groupName": "xxxxxxxx",
"groupId": "xxxxxxxx"
}
],
"subnetId": "xxxxxxx",
"vpcId": "xxxxxxxx"
},
{
"privateIpAddresses": [
{
"privateIpAddress": "xxxxxxxx",
"privateDnsName": null
}
],
"ipv6Addresses": ,
"privateDnsName": null,
"privateIpAddress": "xxxxxxxxxxx",
"networkInterfaceId": "xxxxxxxx",
"securityGroups": [
{
"groupName": "xxxxxxx",
"groupId": "xxxxxx"
}
],
"subnetId": "xxxxxxx",
"vpcId": "xxxxxxx"
},
{
"privateIpAddresses": [
{
"privateIpAddress": "xxxxxxx,
"privateDnsName": null
},
{
"privateIpAddress": "xxxxxxx",
"privateDnsName": ""
},
{
"privateIpAddress": "xxxxxx",
"privateDnsName": ""
},
{
"privateIpAddress": "xxxxxxxx",
"privateDnsName": ""
},
{
"privateIpAddress": "xxxxxxxx",
"privateDnsName": ""
},
{
"privateIpAddress": "xxxxxx,
"privateDnsName": ""
}
],
"publicIp": "xxxxxx,
"privateDnsName": null,
"ipv6Addresses": ,
"networkInterfaceId": "xxxxxxxx",
"securityGroups": [
{
"groupName": "xxxxxxxx",
"groupId": "xxxxxxxxx"
}
],
"privateIpAddress": "xxxxxxx",
"subnetId": "xxxxxxxx",
"vpcId": "xxxxxx",
"publicDnsName": ""
},
{
"privateIpAddresses": [
{
"privateIpAddress": "xxxxxxxxx",
"privateDnsName": null
}
],
"ipv6Addresses": ,
"privateDnsName": null,
"privateIpAddress": "xxxxxxxx",
"networkInterfaceId": "xxxxxxx",
"securityGroups": [
{
"groupName": "xxxxxxxx",
"groupId": "xxxxxxxxx"
}
],
"subnetId": "xxxxxxx",
"vpcId": "xxxxxxxx"

2

Please edit your post, select the JSON, and click on </> in the toolbar about the edit pane. That will improve the formatting of your text.

What is the problem with the current way the data is structured? What do you want to change?

3

Hey Badger,
In that data having different sub fields like privateipaddresses, sunbetid and vpcid etc.so those fields need to create in logstash.

4

If you are using a json filter to parse the message then all of the sub-fields will get created.

5

No, It's not creating.Please tell me how to create those subfileds.

6

If you change your output to

output { stdout { codec => rubydebug } }

then what does an event look like in the output?

7

I have already given same thing in output section,but there is no change.

8

If you do not supply the information required to answer you question you will not get an answer. What does a complete event look like in rubydebug?

9

In output section I have given output { stdout { codec => rubydebug } } and I got the same result

10

He's been asking you repeatedly to post the actual data output that you see. The code that he gave you was not meant to change anything about your results, but to produce the detailed information about your events that is needed to debug your pipeline.

11

Hey Jenni,
It means logstash configuration file.

12

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.