JSON Array in Logstash

Elastic Stack Logstash
1

I have a field which look like this.

"log":"[{\"id\":\"1233\"}, ...some more json]

I want to have a field like

id => 1233

I tried using json filter plugin but I am getting a parse error. What is the ideal way of doing this?

2

You can use the logstash-codec-json to achieve this. We recently added support for arrays in json. Each array entry will become a new event.

Available in 1.5.3

1 Like
3

I've tried json codec and json filter and none of them worked for me.
I have the following JSON:

{"event":{"id":"we4gh64jm3c5v4b8h7gjz","origin":{"idTrace":[],"idRequest":null,"application":{"id":null,"type":null}},"principal":null,"priority":1,"code":200,"headers":{},"payload":[{"Cod":"2544199","Or":[{"StsCod":"0","CodRen":1}]},{"Con":"7499563","Ox":[{"Cod":"2","Ren":1},{"Sts":"0","Cod":1}]}],"replyTo":null,"timestamp":1441275222216},"invalidRequest":false,"internalError":false}

It works fine except for the event.payload field which contains the JSON array unparsed.

When I tried in the input part, the config was:

input {
  lumberjack {
    # The port to listen on
    port => 5043

    # The paths to your ssl cert and key
    ssl_certificate => "/opt/pki/logstash-forwarder.crt"
    ssl_key => "/opt/pki/logstash-forwarder.key"

    codec => json
  }
}

And when I tried in the filter part:

filter {
    json {
        source => "message"
    }
}

Any idea?

Thanks!