Json filter question

Elastic Stack Logstash
1

Hi,

Apologies if this has been asked before.

I am using the file input with no codec specified. I'm just reading some logs. Some of the messages are json but unfortunately also contain some pre and post text wrapping the well formed json. That is not a problem as I can very easily grok out the json itself into a new field.

I can then use that field in the json filter and I get, in my output, a field with the json message.

What I need however is for that json to be split up into its component pieces similar to what I'd get if I were using the json codec in the input block.

Any ideas?

Thanks!

2

Sorry, but I don't understand. If you set the json filter's target option to an empty string (which also happens to be the default) all fields from the JSON object being parsed will be stored in the event root and then I don't see any difference compared to using a codec.

3

Hi @magnusbaeck

Yes, you are quite right of course. I simplified the script to output the value of the target field and the parsed json was there. Another part of the script was wrecking it.

Thanks!