How to load json data into another json data structure

Hello Everyone,

I just need a help in loading data in a nested json format.

I have a output something like this in the below format
"product" : "IPS"
"Product_Country" : "EMEA"
"Tracking_ID": "2335454523"
"StartTime" : "2014-03-05T12:01:04.357Z"
"EndTime" : "2014-03-05T12:02:07.357Z"

But I want the output something like below.

"duration": {
"process_start_time": "2014-03-05T12:01:04.357Z",
"process_end_time": "2014-03-05T12:02:07.357Z"
"status": {
"transaction_number": "2335454523"
"Location": {
"countryName": "EMEA"
"product_details": {
"product_name": "IPS"

For example, value of StartTime and EndTime values should get renamed as "process_start_time" and "process_end_time". Also, these two fields should be nested inside "duration" field. Like this, I want to do for other fields also to follow above nested json structure.

Someone please help me out how can I achieve it as I am new to logstash. kindly post some suggestions or solutions to be followed to achieve the result.

Thank you so much everyone in advance.

You can use mutate+rename to move fields

mutate {
    rename => {
        "StartTime" => "[duration][process_start_time]"
        "EndTime" => "[duration][process_end_time]"
        "Product_Country" => "[location][countryName]"
        ... etc etc

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.