# Insert json string (logtastsh ) - SOLVED

**URL:** <https://discuss.elastic.co/t/insert-json-string-logtastsh-solved/88926>\
**Category:** Logstash\
**Created:** [June 10, 2017, 7:34pm UTC](https://discuss.elastic.co/t/insert-json-string-logtastsh-solved/88926 "2017-06-10T19:34:34Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![rocavalcante](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rocavalcante/32/18648_2.png) [@rocavalcante](https://discuss.elastic.co/u/rocavalcante)\
**Post date:** [June 10, 2017, 7:34pm UTC](https://discuss.elastic.co/t/insert-json-string-logtastsh-solved/88926/1 "2017-06-10T19:34:34Z")

</div>

Hello, I would like to add a json string in the logstash output, and in the future save the output "call output\_db" in a postgreSQL database, however, I still can not get the initial step of inserting the whole string into the logstash output. 😩

logstash.conf:  
input {  
beats {  
port =\> "5043"  
type =\> "json"  
}

}

filter {

```
grok { 
     match => ["message", "%{GREEDYDATA}"]
}

  json{
      source => "message"
      add_field => { "output"=> {"from":"workstationSMD","event":{"product":{},"moment":"2015121418011800","status":{},"data":"%{message}"}}}

    
  }

```

}

output {

```
stdout {
       codec => json_lines

```

# jdbc {

```
# connection_string => "jdbc:postgresql://myip/database"
 # username => "myuser"
  # password => "mypassword"
   # statement => [INSERT INTO logstash_log(log_received)VALUES ('output_db');]
        
    # }
}

```

}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 11, 2017, 8:23pm UTC](https://discuss.elastic.co/t/insert-json-string-logtastsh-solved/88926/2 "2017-06-11T20:23:45Z")

</div>

Have a look a the json\_encode filter for producing the JSON string. Once that's working, reference it in the jdbc output with the standard `%{name-of-field}` syntax.

---

<div class="post-metadata">

**Author:** ![rocavalcante](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rocavalcante/32/18648_2.png) [@rocavalcante](https://discuss.elastic.co/u/rocavalcante)\
**Post date:** [June 12, 2017, 12:41am UTC](https://discuss.elastic.co/t/insert-json-string-logtastsh-solved/88926/3 "2017-06-12T00:41:15Z")

</div>

> [@magnusbaeck](#):
>
> son\_encode filter for producing the JS

Thanks Magnus!

And on the json string in a single field, is it possible? I already researched a lot using json and mutate filter but I was not successful.  
add\_field =\> { "output"=\> {"from":"workstationSMD","event":{"product":{},"moment":"2015121418011800","status":{},"data":"%{message}"}}}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 12, 2017, 6:01am UTC](https://discuss.elastic.co/t/insert-json-string-logtastsh-solved/88926/4 "2017-06-12T06:01:12Z")

</div>

> And on the json string in a single field, is it possible?

Sorry, I don't understand.

> add\_field =\> { "output"=\> {"from":"workstationSMD","event":{"product":{},"moment":"2015121418011800","status":{},"data":"%{message}"}}}

To build a structure like this in Logstash you need to do this:

```plaintext
add_field => {
  "[output][from]" => "workstationSMD"
  "[output][event][moment]" => "2015121418011800"
  "[output][event][data]" => "%{message}"
}

```

I don't think you can create empty hashes (objects) in this manner. You probably need to use a ruby filter for that.

Once you've done the above you should be able to pass the `output` field to the json\_encode filter.

---

<div class="post-metadata">

**Author:** ![rocavalcante](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rocavalcante/32/18648_2.png) [@rocavalcante](https://discuss.elastic.co/u/rocavalcante)\
**Post date:** [June 12, 2017, 12:40pm UTC](https://discuss.elastic.co/t/insert-json-string-logtastsh-solved/88926/5 "2017-06-12T12:40:49Z")

</div>

> [@magnusbaeck](#):
>
> add\_field =\> {  
> "[output][from]" =\> "workstationSMD"  
> "[output][event][moment]" =\> "2015121418011800"  
> "[output][event][data]" =\> "%{message}"  
> }

Thank you so much! Magnus! I will test

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 10, 2017, 12:40pm UTC](https://discuss.elastic.co/t/insert-json-string-logtastsh-solved/88926/6 "2017-07-10T12:40:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.