How to add root level field in logstash json output

My logstash output is like this

{
"a":"b",
"c":"d"
}

I want to add a new field called parent as a root to this existing json like below:

   {   
        "parent":{
            "a":"b",
            "c":"d"
            }
        }

How to add a new field as root level in logstash? can i do it inside filter plugin ?

thanks for reading and helping...

You could do that in a ruby filter

    ruby {
        init => ' Exceptions = [ "@timestamp", "@version", "host", "message", "sequence", "version" ] '
        code => '
            event.to_hash.each { |k, v|
                unless Exceptions.include?  k
                    event.set("[parent][#{k}]", v)
                    event.remove(k)
                end
            }
        '
    }

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.