How to parse nested json

Elastic Stack Logstash
1

this is my json

{"objId":"5586560001","id":"48013895","ts":"2016-03-08 14:45:05.799888","type":"001","comp":"DVD","message":"{\"id_Ext\":\"5586560001\",\"id\":\"001099223100316 12\",\"entryContainerID\":\"1\",\"movement\":\"MODIFIED\",\"coreAttribs\":[{\"id\":\"/Product_CPS\",\"type\":\"SPEC\",\"children\":[{\"id\":\"ExternalCode\",\"type\":\"STRING\",\"value\":\"5586560001\"},{\"id\":\"RefECI\",\"type\":\"STRING\",\"value\":\"001099223100316 12\"},{\"id\":\"General\",\"type\":\"GROUPING\",\"children\":[{\"id\":\"CodigoEmpresa\",\"type\":\"STRING\",\"value\":\"01\"},{\"id\":\"EanGtin\",\"type\":\" ....

i use this conf

file: simple-out.conf

input {
jdbc {
# Oracle jdbc connection string to our database, mydb
jdbc_connection_string => "jdbc:oracle:thin:@(description=(address_list=(address=(protocol=tcp) (host=imdm.pre.eci.geci)(port=1534))(address=(protocol=tcp) (host=imdm.pre.eci.geci)(port=1535)))(connect_data=(service_name=eci_mdmrpp)))"

    # The user we wish to execute our statement as
    jdbc_user => "consulta_mdm"
  jdbc_password => "consulta_mdm"
    # The path to our downloaded jdbc driver
    jdbc_driver_library => "C:\wrk\elasticsearch-2.3.4\logstash-2.3.4\lib\ojdbc6.jar"
    # The name of the driver class for Postgresql
    jdbc_driver_class => "Java::oracle.jdbc.driver.OracleDriver"
    # our query
    statement => "select id_msg as id , message as mensaje from DBMDMRPP.mensajes_dvd  WHERE ID_MSG between 48013816 and  48013900 "
}

}
filter{

	json {
      source  => "mensaje"

}

}
output {
# Para pruebas
# stdout { codec => json_lines }

elasticsearch {
	index => "catalogo"
	document_type => "catalogo"
	hosts => "localhost:9200"	
}

}

this conf parse the json correctly but i try to parse the message field in the json , objid , ts ... are no relevant for me

do youw know how i parse this nested json ?

thanks

2

The question isn't clear to me. Are you having trouble parsing the JSON field? Or do you want to remove e.g. the objId field afterwards? Please show what your event current look like (preferably using a stdout { codec => rubydebug } output) and what you want it to look like instead.