How to parse the following nested json

Elastic Stack Logstash
1

Hello,

I would like to know how to parse the list of nested json "documents" inside a json list field.

Thank you in advance,

There is that list of name and value pairs in the following format:

{
  "list": [
    {
      "name": "colour",
      "value": "blue"
    },
    {
      "name": "size",
      "value": "big"
    }
  ]
}

Example data:

  "httpRequest": {
    "clientIp": "10.223.156.225",
    "country": "IE",
    "headers": [
      {
        "name": "host",
        "value": "host.uat..com"
      },
      {
        "name": "pragma",
        "value": "no-cache"
      },
      {
        "name": "cache-control",
        "value": "no-cache"
      },
      {
        "name": "sec-ch-ua",
        "value": "\"Chromium\";v=\"94\", \"Google Chrome\";v=\"94\", \";Not A Brand\";v=\"99\""
      },
      {
        "name": "sec-ch-ua-mobile",
        "value": "?0"
      },
      {
        "name": "user-agent",
        "value": "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36"
      },
      {
        "name": "sec-ch-ua-platform",
        "value": "\"Windows\""
      },
      {
        "name": "accept",
        "value": "image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8"
      },
      {
        "name": "sec-fetch-site",
        "value": "same-origin"
      },
      {
        "name": "sec-fetch-mode",
        "value": "no-cors"
      },
      {
        "name": "sec-fetch-dest",
        "value": "image"
      },
      {
        "name": "referer",
        "value": "https://host.uat.com/"
      },
      {
        "name": "accept-encoding",
        "value": "gzip, deflate, br"
      },
      {
        "name": "accept-language",
        "value": "en-US,en;q=0.9"
      },
      {
        "name": "cookie",
        "value": "SERVERID=srv2; session=1ad9aa7763623b39-00000001000030e8"
      }
    ],
    "uri": "/favicon.ico",
    "args": "",
    "httpVersion": "HTTP/2.0",
    "httpMethod": "GET",
    "requestId": "1-615b7307-0bd4eea337c65bbf4271d2fa"
  }
2

If you want to flatten those headers there is an example here.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.