If in json nested field

[probson (Philip Robson)]

Hi,

I am trying to use logstash to create a field of dns.type based on the types within dns.answers. This is from event.code 22 from sysmon.

i have tried:

      if "AAAA" in [dns][answers] {
          mutate {
              add_field => {"[dns][type]" => "AAAA"}
            }
        }

also tried KV with no joy.
Any suggestions

dns.answers
	
{
  "type": "AAAA",
  "data": "2a04:4e42::81"
},
{
  "type": "AAAA",
  "data": "2a04:4e42:200::81"
},
{
  "type": "AAAA",
  "data": "2a04:4e42:400::81"
},
{
  "type": "AAAA",
  "data": "2a04:4e42:600::81"
},
{
  "type": "A",
  "data": "151.101.64.81"
},
{
  "type": "A",
  "data": "151.101.128.81"
},
{
  "type": "A",
  "data": "151.101.192.81"
},
{
  "type": "A",
  "data": "151.101.0.81"
}

[aaron-nimocks]

Have you tried

if "AAAA" in [dns][answers][type] {

If that doesn't work can you post an example of your data set?

[probson (Philip Robson)]

@probson

dns.answers
	
{
  "type": "AAAA",
  "data": "2a04:4e42::81"
},
{
  "type": "AAAA",
  "data": "2a04:4e42:200::81"
},
{
  "type": "AAAA",
  "data": "2a04:4e42:400::81"
},
{
  "type": "AAAA",
  "data": "2a04:4e42:600::81"
},
{
  "type": "A",
  "data": "151.101.64.81"
},
{
  "type": "A",
  "data": "151.101.128.81"
},
{
  "type": "A",
  "data": "151.101.192.81"
},
{
  "type": "A",
  "data": "151.101.0.81"
}

Hi @aaron-nimocks,

sysmon with winlogbeats does not give a [dns][answers][type] only the [dns][answers] as below

dns.answers
	
{
  "type": "AAAA",
  "data": "2a04:4e42::81"
},
{
  "type": "AAAA",
  "data": "2a04:4e42:200::81"
},
{
  "type": "AAAA",
  "data": "2a04:4e42:400::81"
},
{
  "type": "AAAA",
  "data": "2a04:4e42:600::81"
},
{
  "type": "A",
  "data": "151.101.64.81"
},
{
  "type": "A",
  "data": "151.101.128.81"
},
{
  "type": "A",
  "data": "151.101.192.81"
},
{
  "type": "A",
  "data": "151.101.0.81"
}

I am trying to end up with the type extracted from that [dns][answers], even if i end up with [dns][answers][type]: AAAA, A

Thanks

[ylasri (Yassine LASRI)]

That will need a ruby filter, try this one

ruby { 
		code => "
				dns_type = event.get('[dns][answers]').find {|h| h['type'] == 'AAAA'}['type'];
				event.set('[dns][type]', dns_type)
				"
	}

[ylasri (Yassine LASRI)]

Check this thread

I would like to access nested data from an array

I have a data structure looking like this: printed as codec => rubydebug { "sequence_number" => 557, "event_tags" => [ [0] { "value" => "nacl-st-qkrrfq-ppu-server-6y35vxntjont", "key" => "originhost" } ] . . . . } or printed as codec => line "event_tags":[{"value":"nacl-st-alcags-ppu-server-zwul4nphc2lc","key":"originhost"}] or from kibana: event_tags { "value": "nacl-st-ibgki7-ppu-server-bl46vcsakx5f", "key": "originhost" } I would like ta add a field calld "originho…

[probson (Philip Robson)]

Hi @ylasri

i removed the =='AAAA' so that it now pulls the type from the array, now need to get it to loop through and append as dns.answers may include multiple types

    ruby { 
		code => "
				dns_type = event.get('[dns][answers]').find {|h| h['type']}['type'];
				event.set('[dns][answers.type]', dns_type)
				"
	    }