JSON Array in Logstash

I have a field which look like this.

"log":"[{\"id\":\"1233\"}, ...some more json]

I want to have a field like

id => 1233

I tried using json filter plugin but I am getting a parse error. What is the ideal way of doing this?

You can use the logstash-codec-json to achieve this. We recently added support for arrays in json. Each array entry will become a new event.

Available in 1.5.3

1 Like

I've tried json codec and json filter and none of them worked for me.
I have the following JSON:


It works fine except for the event.payload field which contains the JSON array unparsed.

When I tried in the input part, the config was:

input {
  lumberjack {
    # The port to listen on
    port => 5043

    # The paths to your ssl cert and key
    ssl_certificate => "/opt/pki/logstash-forwarder.crt"
    ssl_key => "/opt/pki/logstash-forwarder.key"

    codec => json

And when I tried in the filter part:

filter {
    json {
        source => "message"

Any idea?