How to nest all fields in an event under a new field in logstash?

Elastic Stack Logstash
1

Hi all,

How can use logstash to convert an event like this:
{
"@timestamp": "2019-10-29T13:33:46.378Z",
"message": "p_name=yuval;p_surname=khalifa;p_age=41",
"host": "yuvalk",
"p_age": "41",
"@version": "1",
"p_surname": "khalifa",
"p_name": "yuval"
}

to this:
{
"security": {
"@timestamp": "2019-10-29T13:33:46.378Z",
"message": "p_name=yuval;p_surname=khalifa;p_age=41",
"host": "yuvalk",
"p_age": "41",
"@version": "1",
"p_surname": "khalifa",
"p_name": "yuval"
}
}

without handling each field individually by its name.
Is there a way to do that?

2

You could do it using ruby

    ruby {
        code => '
            event.to_hash.each { |k, v|
                event.set("[security][#{k}]", v)
                event.remove(k)
            }
        '
    }

But note that not having a @timestamp field may not work out well for you.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.