Issue in parsing JSON data

Sample Logs

[{
"Name":"abc",
"Phone_no":"9877231",
"Gender":"M"
}
]

I am getting data from filebeat

- paths:
    - /root/test.log
  fields: {log_type: json-multiline}
  multiline.type: pattern
  multiline.pattern: '^\[{'
  multiline.negate: true
  multiline.match: after

And sending to logstash

filter {
json {
source => "message" 
}
}

we want to extract field from json but it not working,

It is solved by making change in pipelines

filter {
grok {
message => ["\[%{GREEDYDATA:msg}\]"]
}
mutate {
gsub => ["msg" , "\n", ""]
}
json {
source => "msg" 
}
}

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.