How to apply json filter to every field that ends with "json"?

Hello,
I'm extracting fields from the message using KV filter, some of these fields might be holding a json value - I would like to iterate all fields and check if the field key ends with "json", to apply json filter on the value.

How can I achieve that?
Thanks for the help.

I think you would have to write code to do that in a ruby filter.

Indeed achieved this using ruby filter:

ruby {
	code => '
		event.to_hash.each do |k,v|
			if k.end_with?("json")
				event.set(k, JSON.parse(v))
			end
		end
	'
}

Thanks for the help.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.