Json Filter

Elastic Stack Logstash
1

Hi,

I have to parse a field which can be in a json format.
is it possible to parse it if json and copy it in a field named json_msg, or send it as text in a field named invalid_json if it's an invalid json ?

Thx for your help.
BR,

2

Not with the json filter alone, but if the JSON parsing fails the event will be tagged _jsonparsefailure and you can then use a mutate filter to copy the JSON string to the invalid_json field for events having that tag.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.