JSON filter (attempt to either prevent recursion or drop unwanted objects / nested fields)

Elastic Stack Logstash
1

I have java/logback feeding a template a la:

                                    <pattern>
                                            {
                                            "environment"   : "somecrazyenvironment",
                                            "appname"       : "somecrazyapplication",
                                            "logger"        : "%logger",
                                            "level"         : "%level",
                                            "thread"        : "%thread",
                                            "method"        : "%class",
                                            "message"       : "%message"
                                            }
                                    </pattern>

which the JSON filter properly handles (and placed into a target json container field "app")

However, the "message" often contains yet more nested JSON. This causes consternation and often field-type conflicts ('tried to parse field [FIELD] as object, but found a concrete value').

Is it possible to prevent descending into nested JSON? (preferred)

Or

Is it possible to do some mutate/drop using some sort of logic based on for [app][NOTsome_json_subfield_i_care_about] ? (seems ugly)

thanks!

2

I'm not following. I'm pretty sure the json filter doesn't recurse into string fields and parse anything that looks like JSON. Could you give a minimal example that exhibits the problem?

3

Perhaps the problem lies elsewhere. I'll follow-up with my java developers. Despite their running application having a logback configured to send the above template, I am finding many more fields (aside those listed) being expanded....

4

I'm facing the same problem. How can I prevent JSON filter to parse the nested objects?

I opened a stackoverflow question:
http://stackoverflow.com/questions/39371129/logstash-json-filter-for-only-one-level