Import JSON with nested fields

If your json file is pretty-printed like that then you will need to use a multiline codec to consume the file as a single event. This is an example of how to do that.

You do not need two json filters. The first one will parse all the nested fields.

The split should be

split { field => "[message][items]" }

You may then want to move some of the fields to the root, which can be done using ruby, like this.

1 Like