How to add a specific key to a field from a JSON format part

Elastic Stack Logstash
1

I was able to get a JSON part from a message in grok.
I want to keep a specific key from the JSON part in a field, how can I do that?

target log:
... snip ... { ... snip ..., "api_code":"40216", ... snip ... } ... snip ...

my grok:

grok{
	"match" => { "message" => " ... snip ... (?<MY_JSON>\{.*\})( %{GREEDYDATA:message})? ... snip ..." }
}

result:
MY_JSON : { ... snip ..., "api_code":"40216", ... snip ... }

expect:

MY_JSON  : { ... snip ..., "api_code":"40216", ... snip ... }
api_code : 40216
2

Can anyone give me some good ideas?

3

Yeah. I see what you mean.

It looks like it uses the json plugin.

I thought I'd have to use regular expressions, but Logstash has a nice feature.

Here is the code I wrote.

if( [MY_JSON] ) {
  json {
    source => "MY_JSON"
  }
}
1 Like
4

Note that this method adds all the values in json format to the field.

If you don't want to include them in the field, use remove_field.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.