How to extract the data?

[yuva_rajan]

Below is the data in json

{
"_source": {
"notification": {
""eventDescription": "[Monitored alert priority >=4] [***] [https://***] [The application powershell.exe is executing a fileless script or command.] [Incident id: ***] [Threat score: 4] [Group: ******] [Email: ****] [Name: ******] [Type and OS: WINDOWS Windows 10 x64] [Severity: Monitored]\n","
}
}
}

I want parse the data of eventDescription field. Help is needed.

[Gomathi_Meena]

From where you wanted to parse the data ? Can you mention it little bit clearly ..Are you trying to parse the data from elasticsearch to somewhere else ??

[yuva_rajan]

Hi,

From logstash.

[Gomathi_Meena]

You can use the kv filter's include_keys option to parse only the particular field from logstash to elastic search .
refer :https://www.elastic.co/guide/en/logstash/6.5/plugins-filters-kv.html
Hope it helps.

[yuva_rajan]

@Gmoathi.. Didnt work..

[Badger]

The message is delimited using [ and ], so I would use a dissect filter for that.

[yuva_rajan]

@Badger

dissect

@Badger, i will check and get back to you

[yuva_rajan]

dissect filter helps me to extract it..