How to prevent json parsing of a field in Logstash?

Elastic Stack Logstash
1

Hi,

I am using Logstasg GA 6.3.0. I am taking data from a kafka topic like below;

input {
	kafka{
		group_id => "mygroup"
		topics => ["mytopic"]
		bootstrap_servers => "192.168.0.1:9092"
		codec => "json"
	}
}

everything is working fine. My data has many fields like field_a, field_b etc, which gets automatically parsed with the help of JSON codec. one of my fields field_c has another JSON data in it. Logstash also parses that and I can see the child elements as attributes in Kibana. I don't want that. I want that JSON as plain text, which means Logshash should not tokenize field_c. Is this possible?

Thanks.

2

I don't think you can prevent it parsing it, but you could use the json_encode plugin to overwrite it with serialized JSON.

3

Hi @Badger , when I looked into the documentations, I was able to see add_field, add_tag, enable_metric, id, periodic_flush, remove_field, and remove_tag options. Could you kindly tell me what should I use here, and how to use?

4

You do not need to use the "Common Options". Just try

json_encode { source => "field_c" }

and it will overwrite field_c with its serialized version.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.