I have the following field parsed using JSON filter json { source => "log" target => "request" skip_on_invalid_json => true } But there is a field in "request" which still prints as JSON String request.headers.x-user-agent : {"platform":"android","app_version":"2.…

[request][headers][x-user-agent] is an array field so you need to tell Logstash to parse its first element (i.e. [request][headers][x-user-agent][0]).

JSON Parse an already parsed field

Elastic Stack Logstash

magnusbaeck (Magnus Bäck) September 3, 2018, 6:09am 2

Please show example what the event looks like. Use a stdout { codec => rubydebug } output to dump the raw event (or copy/paste the JSON from Kibana's JSON tab).

Topic		Replies	Views
Parsing a JSON array of objects with field-value Logstash	2	1126	October 5, 2017
Parsing json array Logstash	6	349	June 16, 2021
Logstash Parse stingyfied json to seperate json fieldsl Logstash	1	296	April 3, 2023
Parsing nested json object and make as a single filed Logstash	4	367	August 10, 2018
Json nested field Logstash	3	368	February 8, 2022

JSON Parse an already parsed field

Related topics