How to write Customize grok with multiple json values?

[Badger]

@Badger

mutate { gsub => [ "message", "[{", "", "message", "}]", "", "message", "}, {", "|" ] } mutate { split => { "message" => "|" } } kv { source => "[message][0]" target => "[foo][0]" field_split => "," }

OK, well it turns out kv handles an array on input, so you can do

kv { source => "[message]" target => "[foo]" field_split => "," }

If you then want to have the arrays inverted, you could do that in ruby using something like this.