How to select specific field value

Elastic Stack Logstash
1

For example:

How to turn

{"name":"James","location":{"city":"A City","address":""}}

into

{"city":"A City","address":""}

2

Hi,

Maybe with this :

mutate {
copy => { "[location]" => "my_new_field" }
}

3

Also you could try the mutate/split filter,

mutate {
split => ["message",","]
add_field => { "city" => "%{[message][1]}"}
}

Regards

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.