I have the following field parsed using JSON filter json { source => "log" target => "request" skip_on_invalid_json => true } But there is a field in "request" which still prints as JSON String request.headers.x-user-agent : {"platform":"android","app_version":"2.…

[request][headers][x-user-agent] is an array field so you need to tell Logstash to parse its first element (i.e. [request][headers][x-user-agent][0]).

Discuss the Elastic Stack

JSON Parse an already parsed field

Elastic Stack Logstash

NerdSec (Nachiket) September 4, 2018, 5:33am 10

Hi magnus,

I was able to parse the json object as seperate fields using the ruby filter, but i am not sure how to join the fields. Could you provide some pointers?

Not sure if I should post it here or not. I have posted it in the original thread that I had created.

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.