How to fetch first value in json file if field is coming up multiple times

Elastic Stack Logstash
1

Hi,

If my input json file is setting 1 field value twice in the file . Can we fetch particular value in that case?

Eg :

"message": "{"modelVersion":" 12.2.0.1.3_20170331", "RackType":"N/A","EngineeredSystems":"Big Data Appliance","RackIdentifier":"", "OSVersion":"6.4","DBVersion":"","ExadataVersion":"","HardwareType":"",\r\n"exachkExecTimestamp":"2017-08-04 21:53:10 UTC", \r\n"exachkID":"E2103E2271EB0733E04312C0E50A10B0",\r\n"exachkType":"OS",\r\n"exachkName":"Verify NTP Synchronization", \r\n"exachkAlertType":"WARNING",\r\n"exachkTargetType":"HOST", \r\n*"exachkStatus":"FAIL"**, \r\n"exachkStatusCode":"3", \r\n *"exachkStatus":"3"**, \r\n"exachkmessage":"NTP is not synchronize.", \r\n"exachkMsgDetail":"DATA FROM SCAJ51BDA16-ADM - VERIFY NTP SYNCHRONIZATION \n\n\n\n remote refid st t when poll reach delay offset jitter\n==============================================================================\n 127.127.1.0 .LOCL. 10 l 39 64 377 0.000 0.000 0.001\n*10.68.0.41 10.210.60.196 2 u 12 16 377 3.447 0.000 0.039\n+10.68.0.42 10.210.60.196 2 u 7 16 377 3.483 -0.087 0.097\n",\r\n "NodeName":"scaj51bda16-adm" \r\n}\r",

Now the value coming in exachkstatus is 3 can we set the Fail value in exachkstatus?

2

If my input json file is setting 1 field value twice in the file .

Then it's not valid JSON.

Can we fetch particular value in that case?

No. Logstash's behavior with duplicate keys is undefined.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.