JSon Array parsing - Field name

Elastic Stack Logstash
1

Hi,

I manage to parse JSON array with logstash (Returns/Row)
My configuration is

...
filter {
split {
field => "Returns[Row]"
add_field => [ "name" , "%{Returns.Row.name}"]
}
}
output {
stdout { codec => "rubydebug" }
}

But I get Returns.row.xxx as output field name. So I try the add field option wihtout success
Any clue ?

Here is the output i get

{
"Returns" => {
"Row" => {
"name" => "LOCAL.ESB.MONITORING_ROUTER.AuditNotification",
"pendingMessageCount" => "106"
}
},
"@version" => "1",
"@timestamp" => "2015-10-23T16:25:54.534Z",
"name" => "%{Returns.Row.name}"
}
{
"Returns" => {
"Row" => {
"name" => "LOCAL.ESB.CORE_AUDIT.LogEvent",
"pendingMessageCount" => "138"
}
},
"@version" => "1",
"@timestamp" => "2015-10-23T16:25:54.534Z",
"name" => "%{Returns.Row.name}"
}

Thanks for your help

2 
field => "Returns[Row]"

What's this syntax supposed to mean? Do you mean [Returns][Row]?

But I get Returns.row.xxx as output field name.

The field reference Returns.Row.xxx literally means "the field named Returns.Row.xxx", i.e. the following JSON snippet:

"Returns.row.xxx": { ... }

If the structure actually looks like

"Returns": {
  "Row": {
    "xxx": { ... }
  }
}

you need [Returns][Row][xxx].

3

Hi Magnus,

Sorry for the late reply. It works fine with [Returns][Row] :smile:
Thank you for your help

Jeremy

4

how do I parse array of jsons something similar to
[
{"id" : "kvkevbe"
},
{"id" : "nfavnkv"
},
{"id" : "knknks"
},
{"id" : "fkoiuhu"
}
]
can some one please help?!