I am not clear with these method. I have separate json file and I am getting all the values from that file. I have to parse those json files when the 'message' contains some specific string I have to parse only those type of json values.
for example,
json file,
{
"index_name" : "sample_index-%{+YYYY.MM.dd}",
"host" : "localhost",
"fields" : "example-query, testing-process",
"example-query" : {
"keywords" : ["processid","date"],
"f_split" : ", ",
"v_split" : "="
},
"testing-process" : {
"isSearchKey" : "false",
"keywords" : ["processvalue","activitydate"],
"f_split" : ";",
"v_split" : ":"
}
}
from this json example, If my message field contains "fields" : "example-query, testing-process", any of this one fields value it will take the respective values from json file. from that value I have to parse those values.