How do I read nested JSON?

(John Yeuk Hon Wong) #1


Here is part of the JSON doc in Kibana after I use JSON filter to process incoming log.

    "OldStateValue": "INSUFFICIENT_DATA",
"Trigger": {
  "MetricName": "CPUUtilization",
  "Namespace": "AWS/EC2",
  "Statistic": "AVERAGE",
  "Unit": null,
  "Dimensions": [
      "name": "InstanceId",
      "value": "i-9e0a8763"
  "Period": 300,
  "EvaluationPeriods": 12,
  "ComparisonOperator": "GreaterThanThreshold",
  "Threshold": 95

I tried the followings with json filter;

source => "Trigger"
source => "Trigger.Dimensions"
source => "Trigger\.Dimensions"

But none of them work. Essentially I wanted to build a new field called InstanceId by reading the "value" kv from the inner JSON document of Trigger KV

In Python I am going to do TriggerObject["Dimensions"]["value"]. What's the syntax to read that in logstash?


(Rafał Trójniak) #2

Hello @John_Yeuk_Hon_Wong ,
To refer to nested field you have to use brackets (like [Trigger][Namespace] )
That is documented here :

(Jeremy Page) #3

I don't see it in the link provided but try:


(system) #4