How to flatten the json, not working with previous post

[rkhapre (RK)]

Hi All

I have a case, wherein i need to flatten the json data.To get started i am just following the previous post.
But i am not successful with the result

Indent any json file nested fields and make it flat

You will need a ruby script. Create a file called flattenJSON.rb that contains def register(params) @field = params['field'] end def flatten(object, name, event) if object if object.kind_of?(Hash) and object != {} object.each { |k, v| flatten(v, "#{name}.#{k}", event) } else event.set(name, object) end end end def filter(event) o = event.get(@field) if o flatten(o, @field, event) end event.remove(@field) […

I am getting below result

{
	"@timestamp" : "2020-03-08T15:09:09.688Z",
	"message" : "        \"input\": {\r",
	"@version" : "1",
	"path" : "/bin/file_data/json_data.json",
	"host" : "xxxx",
	"type" : "json"
}{
	"@timestamp" : "2020-03-08T15:09:09.698Z",
	"message" : "            \"information\": {\r",
	"@version" : "1",
	"path" : "/bin/file_data/json_data.json",
	"host" : "xxxxx",
	"type" : "json"
}{
	"@timestamp" : "2020-03-08T15:09:09.698Z",
	"message" : "            \"value\": {\r",
	"@version" : "1",
	"path" : "/bin/file_data/json_data.json",
	"host" : "xxxxx",
	"type" : "json"
}{
	"@timestamp" : "2020-03-08T15:09:09.708Z",
	"message" : "                    \"AVB\"\r",
	"@version" : "1",
	"path" : "/bin/file_data/json_data.json",
	"host" : "xxxxx",
	"type" : "json"
}
.....

This is my conf file

input{
file {
path => "/bin/file_data/json_data.json"
sincedb_path => "/bin/file_data/sincedb.txt"
type => "json"
start_position => "beginning"
}
}

filter {

ruby {
path => '/flattenJSON.rb'
script_params => { field => "body" }

}

}

output {
file {
path => "/test/test.json"
}
}

[Badger]

You appear to have a file containing a pretty-printed JSON object. You will need to use a multiline codec to consume it. Take a look at this.

[rkhapre (RK)]

Okay, i tried with single line json file, i got some improvement, but still no result

`Below is my result

{"body" :{"BlockName":"SA","input" : {"type" :"array","identification" :"iValue","configs" : {},"information" : {"location" :"Users\\files\\","client_id" : "abd"},"value" : {"info" :["Apple","MSFT", "AVB"],"domains" : ,"uniqueId" : "1108738857225224193","restul_set" : [0.4112226366996765, 0.34098902344703674, 0.24778836965560913],"timestamp" :1554940800000,"text" :"Test Text"}}},"result" :0.06}

My expectation is to get the data like this

body.BlockName: SA
body.input.type: array
body.input.identification: iValue

.....

`

[Badger]

OK, so you need a json filter.

[rkhapre (RK)]

okay i added the json file, then also same result, i am not getting the flattened json as mentioned in that post

i am using version, 6.8.4

json {
    source => "message"
    target => "message"
}

[Badger]

Try 'target => "body"'.

[rkhapre (RK)]

it worked.Thanks