Http_poller input and excluding parent json properties for output to elastic

Elastic Stack Logstash
1

afternoon

My poller reads from a source where the array that I wish to be the source of the Elasticsearch output plugin in not the parent and not the only property.

How can I either filter appropriately OR instruct the Elasticsearch output plugin to ignore other properties and pull from the array that is nested?

I thank you

2

Possibly some combination of a prune filter to remove unwanted fields, and a mutate filter to move the interesting array to the top level. Without seeing an example of the data it is hard to say.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.