My logstash output is like this
{
"a":"b",
"c":"d"
}
 
I want to add a new field called parent as a root to this existing json like below:
   {   
        "parent":{
            "a":"b",
            "c":"d"
            }
        }
 
How to add a new field as root level in logstash?  can i do it inside filter plugin ?
thanks for reading and helping...
             
            
               
               
               
            
                
            
           
          
            
              
                Badger  
                
               
              
                  
                    June 10, 2019,  5:41pm
                   
                   
              2 
               
             
            
              You could do that in a ruby filter
    ruby {
        init => ' Exceptions = [ "@timestamp", "@version", "host", "message", "sequence", "version" ] '
        code => '
            event.to_hash.each { |k, v|
                unless Exceptions.include?  k
                    event.set("[parent][#{k}]", v)
                    event.remove(k)
                end
            }
        '
    } 
             
            
               
               
               
            
            
           
          
            
              
                system  
                (system)
                  Closed 
               
              
                  
                    July 8, 2019,  5:41pm
                   
                   
              3 
               
             
            
              This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.