How do I read nested JSON?

Elastic Stack Logstash
1

Hi.

Here is part of the JSON doc in Kibana after I use JSON filter to process incoming log.

    "OldStateValue": "INSUFFICIENT_DATA",
"Trigger": {
  "MetricName": "CPUUtilization",
  "Namespace": "AWS/EC2",
  "Statistic": "AVERAGE",
  "Unit": null,
  "Dimensions": [
    {
      "name": "InstanceId",
      "value": "i-9e0a8763"
    }
  ],
  "Period": 300,
  "EvaluationPeriods": 12,
  "ComparisonOperator": "GreaterThanThreshold",
  "Threshold": 95
}

I tried the followings with json filter;

source => "Trigger"
source => "Trigger.Dimensions"
source => "Trigger\.Dimensions"

But none of them work. Essentially I wanted to build a new field called InstanceId by reading the "value" kv from the inner JSON document of Trigger KV

In Python I am going to do TriggerObject["Dimensions"]["value"]. What's the syntax to read that in logstash?

Thanks.

2

Hello @John_Yeuk_Hon_Wong ,
To refer to nested field you have to use brackets (like [Trigger][Namespace] )
That is documented here :
https://www.elastic.co/guide/en/logstash/current/configuration.html#logstash-config-field-references

3

I don't see it in the link provided but try:

[Trigger][Dimensions]