How to access input json message field?

Elastic Stack Logstash
1

Hi, i want to access type and logs field from input json

here is input json

{
"type": "dmesg",
"hostName": "ramesh-nagargoje",
"os": "windo",
"bseid": 1234,
"logs": "[ 0.000000] Initializing cgroup subsys cpuset\n[ 0.000000] Initializing cgroup subsys cpu\n[ 0.000000] Initializing cgroup subsys cpuacct\n[ 0.000000] Linux version 3.13.0-144-generic (buildd@lgw01-amd64-059)"
}

and here is config file i have used but i am not getting how to access type and log field from input message.

input
{
kafka
{

       }

}
filter
{

    #json
    #{
    #       source => "message"
    #       target => "message"
    #}

    if [message][type] == 'dmesg'
    {
            mutate
            {
                    add_field  => {"tag"=>"tagname"}
            }
    }

}

output
{
stdout
{
codec=> json
}
}

2

@magnusbaeck please help

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.