I have the following field parsed using JSON filter json { source => "log" target => "request" skip_on_invalid_json => true } But there is a field in "request" which still prints as JSON String request.headers.x-user-agent : {"platform":"android","app_version":"2.…

[request][headers][x-user-agent] is an array field so you need to tell Logstash to parse its first element (i.e. [request][headers][x-user-agent][0]).

Discuss the Elastic Stack

JSON Parse an already parsed field

Elastic Stack Logstash

NerdSec (Nachiket) September 4, 2018, 5:33am 10

Hi magnus,

I was able to parse the json object as seperate fields using the ruby filter, but i am not sure how to join the fields. Could you provide some pointers?

Not sure if I should post it here or not. I have posted it in the original thread that I had created.

Topic		Replies	Views
Json Filter Logstash	2	328	January 13, 2019
Json Parsing Logstash	8	287	November 10, 2021
How to use the JSON filter correctly? Logstash	14	1919	August 25, 2023
Parse Json data wrapped in "message" into event fields Logstash	6	10716	July 6, 2017
JSON input field Logstash	14	558	February 27, 2020

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

JSON Parse an already parsed field

Related topics