How to load json data into another json data structure

[venkataraman]

Hello Everyone,

I just need a help in loading data in a nested json format.

I have a output something like this in the below format
{
"product" : "IPS"
"Product_Country" : "EMEA"
"Tracking_ID": "2335454523"
"StartTime" : "2014-03-05T12:01:04.357Z"
"EndTime" : "2014-03-05T12:02:07.357Z"
}

But I want the output something like below.

{
"duration": {
"process_start_time": "2014-03-05T12:01:04.357Z",
"process_end_time": "2014-03-05T12:02:07.357Z"
},
"status": {
"transaction_number": "2335454523"
},
"Location": {
"countryName": "EMEA"
},
"product_details": {
"product_name": "IPS"
}
}

For example, value of StartTime and EndTime values should get renamed as "process_start_time" and "process_end_time". Also, these two fields should be nested inside "duration" field. Like this, I want to do for other fields also to follow above nested json structure.

Someone please help me out how can I achieve it as I am new to logstash. kindly post some suggestions or solutions to be followed to achieve the result.

Thank you so much everyone in advance.

[Badger]

You can use mutate+rename to move fields

mutate {
    rename => {
        "StartTime" => "[duration][process_start_time]"
        "EndTime" => "[duration][process_end_time]"
        "Product_Country" => "[location][countryName]"
        ... etc etc
    }
}