Http_poller plugin and parsing second level of json

Elastic Stack Logstash
1

Hello, I am using Http_poller plugin for get api call.
My conf.file:

input {
  http_poller {
    urls => {
      test2 => {
        method => get
        url => "https://somethin.somethin.kz/uapi/tickets?api_token=fdfhg22fg5&fstatus=3"
        headers => {
          Accept => "application/json"
        }
      }
    }
    request_timeout => 60
    # Supports "cron", "every", "at" and "in" schedules by rufus scheduler
    schedule => { cron => "/2 * * * *"}
    # A hash of request metadata info (timing, response headers, etc.) will be sent here
    metadata_target => "http_poller_metadata"
  }
}

filter {
}...

In Elasticsearch I get this results:
image

image
image813×468 19.4 KB

But I need text in TAGS field be separated as a single fields (to be parsed too). What I have to use to separate them?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.