How do I parse inner fields from json?

[Ben_Davis]

My log is full of nested json like so...

   {
         "foo": 1, 
              "result":{
                   "time":"2017-01-09T02.01:50.000+0000",
                   "product":"blahblah",
                   "quantity":"20"
              }
         }
    }

I only care about the innermost fields named time, product, and quantity. I want logstash to parse those into individual fields.

I've tried

filter{
   json{
      source => "result"
   }
}

And the output is one huge string containing the result field, it does not parse out the contents.

I've been all over the documentation but can't get it right. Any advice?

thank you,

• Ben

[Andrew_Cholakian1 (Andrew Cholakian)]

@Ben_Davis you probably want to use a json or json_lines codec (not filter) with whatever input you're using. So, if you're using the stdin input you'd want input { stdin => { codec => json_lines } } in your input section. Then, you would use a prune filter to pick which fields you do/don't want.

[Ben_Davis]

Thank you very much!

including

codec => "json"

in the input section seems to have done the trick.