Hello
I need a little help.
I want to fetch some nested json data into separate fields
input {
beats {
port => 5044
}
}
filter {
if "/var/log/ABC.log" in [log][file][path] {
grok {
match => { "message" => '^%{GREEDYDATA}"Status":"%{WORD:Status}"%{GREEDYDATA}$' }
}
grok {
match => { "message" => '^%{GREEDYDATA}"TransactionNumber":"%{NUMBER:TransactionNumber}"%{GREEDYDATA}$' }
}
grok {
match => { "message" => '^%{GREEDYDATA}"CountryCode":"%{WORD:CountryCode}"%{GREEDYDATA}$' }
}
grok {
match => { "message" => '^%{GREEDYDATA}"RequestID":"%{WORD:RequestID}"%{GREEDYDATA}$' }
}
grok {
match => { "message" => '^%{GREEDYDATA}"Amount":"%{NUMBER:Amount}"%{GREEDYDATA}$' }
}
grok {
match => { "message" => '^%{GREEDYDATA}"SubCategory":"%{WORD:SubCategory}"%{GREEDYDATA}$' }
}
grok {
match => { "message" => '^%{GREEDYDATA}"CustomerID":"%{WORD:CustomerID}"%{GREEDYDATA}$' }
}
grok {
match => { "message" => '^%{GREEDYDATA}"CustomerNumber":"%{WORD:CustomerNumber}"%{GREEDYDATA}$' }
}
}
}
above is my logstash config