How to convert a nested field type?

I find mutate filter can convert a field type, but how to convert a nested one?

I've tried:

mutate {
    convert => {"logdetail.params" => "string"}
}

And

mutate {
    convert => {"[logdetail][params]" => "string"}
}

But failed.

The latter should work. What does the message look like? Please use a stdout { codec => rubydebug } output so we get the raw data.

{
    "@timestamp" => 2016-04-01T06:17:16.494Z,
          "host" => "shifudao",
          "type" => "rtds",
      "loglevel" => "WARN",
     "classname" => "hawkeyes.rtds.gate.protocol.frametype.SamplerReportData",
     "logdetail" => {
        "message" => "设备00004650数据上报帧里的sid为空,可能未发过心跳,丢弃!",
         "action" => "fireEquipmentDataArrived(String writeHandlerID, String sid, Vertx vertx, List result)",
            "sid" => nil,
         "params" => {
            "writeHandlerID" => "b6728301-653e-488c-91b8-fc2aa52c1312",
                       "sid" => nil,
                    "result" => [
                [0] {
                      "eId" => "00004650",
                     "date" => 963328184494,
                    "items" => [
                        [0] [
                            [0] 1,
                            [1] [
                                [0] 74,
                                [1] 0,
                                [2] 0,
                                [3] 0
                            ]
                        ],
                        [1] [
                            [0] 2,
                            [1] [
                                [0] -119,
                                [1] 0,
                                [2] 0,
                                [3] 0
                            ]
                        ],
                        [2] [
                            [0] 3,
                            [1] [
                                [0] 12,
                                [1] 0,
                                [2] 0,
                                [3] 0
                            ]
                        ],
                        [3] [
                            [0] 4,
                            [1] [
                                [0] 12,
                                [1] 0,
                                [2] 0,
                                [3] 0
                            ]
                        ],
                        [4] [
                            [0] 5,
                            [1] [
                                [0] 110,
                                [1] 5,
                                [2] 0,
                                [3] 0
                            ]
                        ],
                        [5] [
                            [0] 6,
                            [1] [
                                [0] 61,
                                [1] 5,
                                [2] 0,
                                [3] 0
                            ]
                        ],
                        [6] [
                            [0] 7,
                            [1] [
                                [0] -18,
                                [1] 5,
                                [2] 0,
                                [3] 0
                            ]
                        ],
                        [7] [
                            [0] 8,
                            [1] [
                                [0] 3,
                                [1] 8,
                                [2] 0,
                                [3] 0
                            ]
                        ],
                        [8] [
                            [0] 9,
                            [1] [
                                [0] 0,
                                [1] 0,
                                [2] 0,
                                [3] 0
                            ]
                        ]
                    ]
                }
            ]
        }
    },
      "@version" => "1"
}

logdetail.params is a nested json object, and I want to convert it to string.

Oh. Such objects can't be converted to a string (see below). Perhaps the json_encode filter would be useful?

Oh, I read the official doc carefully, and I find this reason:

 If the field is a hash, no action will be taken.

So this field is a hash. But how to I perform a toString() action?

But json_encode convert a string to json. I want to convert a nested json to string. How to?

No, you have a field that happens to be nested that you for some reason want to transform to a string representation. The json_encode filter serializes a field to JSON. JSON is a string.

Great! json_encode works for me now.

And is there any built-in filter alternative ? Maybe ruby could also work, but I'm not good at not ruby. I don't know how to use ruby to implement.

And is there any built-in filter alternative ?

Alternative that does what?

Do the same with json_encode, just like my title. But it's a built-in filter. Maybe the ruby filter could do the same thing, but I'm not good at ruby, is there any examples?

So what you're really asking for is JSON serialization with a core plugin? That should indeed be possible with a ruby filter but I don't have any example at hand, except of course the json_encode source code.

Thanks all the same.