Is there a way to create nested structures in logstash?


(David Lang) #1

For example, I want to have the output be something like:

{
  "trusted" : {
     "logstash": {
       "host": "some IP",
       "timereceived": "some timestamp"
    }
  }
}

does logstash follow the project lumberjack convention of allowing me to define names like trusted!logstash!host or something like that?

David Lang


(Magnus B├Ąck) #2

This should be helpful: https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html#logstash-config-field-references


(system) #3