JSON Parse an already parsed field

[NerdSec (Nachiket)]

Hi magnus,

I was able to parse the json object as seperate fields using the ruby filter, but i am not sure how to join the fields. Could you provide some pointers?

Not sure if I should post it here or not. I have posted it in the original thread that I had created.

JSON array parsing in Logstash using the ruby filter

This is getting parsed properly according to Logstash, but it is getting indexed as a nested object in Elasticsearch. As they are not well supported in Kibana, I hope to create a flat structured array using the ruby filter. Here is my config: input { file { path => "/home/fire.log" sincedb_path => "/dev/null" start_position => "beginning" codec => json } } filter { ruby { code => " message_array = event.get('[alert][explanation][cnc-services][cnc-service]') …