How to create fields from nested fields for json data in logstash

Elastic Stack Logstash
4

It is not quite what you asked for, but should give you something to work with

    ruby {
        code => '
            def flattenObject(object, name, event)
                if object
                    if object.kind_of?(Hash) and object != {}
                        object.each { |k, v| flattenObject(v, "#{name}.#{k}", event) }
                    elsif object.kind_of?(Array) and object != []
                        object.each_index { |i|
                            flattenObject(object[i], name + "_#{i}", event)
                        }
                    else
                        event.set(name, object)
                    end
                end
            end

            fieldName = "service.action.portProbeAction.portProbeDetails"
            o = event.get(fieldName)
            if o
                flattenObject(o, fieldName, event)
            end
            event.remove(fieldName)
        '
    }

will produce

 "service.action.portProbeAction.portProbeDetails_0.remoteIpDetails.organization.asnOrg" => " ",
    "service.action.portProbeAction.portProbeDetails_0.remoteIpDetails.geoLocation.lat" => 20.7386,
"service.action.portProbeAction.portProbeDetails_1.remoteIpDetails.country.countryName" => "Russia",
   "service.action.portProbeAction.portProbeDetails_1.remoteIpDetails.organization.org" => " ",
          "service.action.portProbeAction.portProbeDetails_0.localPortDetails.portName" => "HTTPS",
   "service.action.portProbeAction.portProbeDetails_0.remoteIpDetails.organization.isp" => " ",
"service.action.portProbeAction.portProbeDetails_0.remoteIpDetails.country.countryName" => "us",
    "service.action.portProbeAction.portProbeDetails_1.remoteIpDetails.geoLocation.lon" => 8.6068,
    "service.action.portProbeAction.portProbeDetails_0.remoteIpDetails.geoLocation.lon" => -56.6068,
      "service.action.portProbeAction.portProbeDetails_0.remoteIpDetails.city.cityName" => "",
   "service.action.portProbeAction.portProbeDetails_1.remoteIpDetails.organization.isp" => " ",
   "service.action.portProbeAction.portProbeDetails_0.remoteIpDetails.organization.org" => " ",
"service.action.portProbeAction.portProbeDetails_1.remoteIpDetails.organization.asnOrg" => " ",
          "service.action.portProbeAction.portProbeDetails_1.localPortDetails.portName" => "HTTP",
    "service.action.portProbeAction.portProbeDetails_1.remoteIpDetails.geoLocation.lat" => 21.7386,
      "service.action.portProbeAction.portProbeDetails_1.remoteIpDetails.city.cityName" => "",
   "service.action.portProbeAction.portProbeDetails_0.remoteIpDetails.organization.asn" => "49505",
        "service.action.portProbeAction.portProbeDetails_1.remoteIpDetails.ipAddressV4" => "76.98.213.56",
              "service.action.portProbeAction.portProbeDetails_1.localPortDetails.port" => 80,
   "service.action.portProbeAction.portProbeDetails_1.remoteIpDetails.organization.asn" => "49505",
        "service.action.portProbeAction.portProbeDetails_0.remoteIpDetails.ipAddressV4" => "76.98.213.56",
              "service.action.portProbeAction.portProbeDetails_0.localPortDetails.port" => 443,