How logstash uses add_field to add a JSON array

The raw data are as follows

        "money快照" => [
            [0] "money:14683689,value:15105589,time:2021-07-27 23:50:54",
            [1] "money:14683689,value:15105589,time:2021-07-27 23:50:56"
        ],

The configuration file is as follows

       mutate {
                #gsub => ["jsonmsg","\[","\{" ]
                #gsub => ["jsonmsg","\]","\}" ]
                remove_field => ["message"]
                add_field => {
                         "value1" => "%{[money快照][0]}"
                }
       }

give the result as follows

"value1" => "%{[money快照][0][value]}",

You may need to use something like that

filter {
  if [money]{
    json {
      source => "money"
      target => "money"
    } 
  }
}

The result here has been parsed by the JSON plug-in. I now want to map the value field to the top-level field.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.