I've been looking around and experimented a bit, but haven't gotten it to work or so to say.
I have a tcp input with the json codec, along with an elasticsearch output with a template that adds some custom fields. I used to just use a grok-pattern to match the logger message to separate it to different fields, however I'm wondering if I could use a JSON logger message, and use a json filter and set the source of the filter to parse it into fields.
but that doesn't seem to work. I've looked around and maybe the Split filter may work if the object is changed into an array? I quickly experimented with it and wasn't able to get it to work.
Sorry for the questions, I'm quite the beginner and am curious if I could do this instead of using our existing grok-pattern filter.
Ok, I think you are probably onto something. I tried omitted the "target" option before and got a _jsonparsefailure tag before and didn't think too much about it, but it's possibly my logger message is still not correctly configured. I'll try some other things.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.