padamrai
(Padam Rai)
January 28, 2022, 12:38pm
1
Hello Friends,
Need your help to parse string into Json format in logstash.
{
"id":"xxx",
"MessageCreateDate":"2022-01-20",
"Response":"{'Cardholder':{'cards':[{'isPrimaryCard':'N','cardNumber':'xxxxxxxxxx','referenceID':'xxxxxxx','customerId':'xxxx
xxxxxxxxxxxxx','billingCurrencyCode':'xxx','allocatedCreditLimit':00.00,'pendingTransactionsBalance':0.00,'allocatedCashAdvanceLimit':00.00,'baseCreditLimit':00.00,'outstanding
SettlementBalance':0.00}],'responseCode':'00','responseDesc':'YES','fee':0.00,'balance':0.0
0,'lastDepositAmount':0.00,'ledgerBalance':0.00}}"
}
I want to convert Response into JSON format from string. Everything is in json format except outer inverted commas. Is it any way to convert whole string to json format?
Badger
January 28, 2022, 3:57pm
2
If I use a multiline codec to consume that then
mutate { gsub => [ "message", "[\r\n]", "" ] }
mutate { gsub => [ "message", ":00+", ":0" ] }
json { source => "message" remove_field => [ "message" ] }
mutate { gsub => [ "Response", "'", '"' ] }
json { source => "Response" }
works for me.
1 Like
padamrai
(Padam Rai)
January 31, 2022, 10:17am
4
It is working fine now.
mutate{
gsub => ["MethodParameter", "[\r\n ]", ""]
}
mutate{
gsub => ["MethodParameter", '\"', '"']
}
json {
source => "MethodParameter"
target => "MethodParameter_Json"
}
mutate{
remove_field => ["MethodParameter"]
}
system
(system)
Closed
February 28, 2022, 10:18am
5
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.