Json Parsing

[John_snow (John)]

i have event coming in my logstash as a json

{"key1": "value1", "key2": "value2", "key3": {"key4": "value4"}}

I wanted too put that event inside a key data like

{"data" : {
           "key1": "value1", 
           "key2": "value2", 
           "key3": {"key4": "value4"}
       }
}

But not sure how i can do that in logstash.

Also i wanted add new fields in the event as

 {
     "data" : {
                "key1": "value1", 
                "key2": "value2", 
                "key3": {
                         "key4": "value4"
                        }
              },
     "new_filed": "new_value"
}

[Badger]

You could parse the JSON with a json filter and use the target option to put it into a field.

To add new fields you can use the common option add_field that works on all filters.

[John_snow (John)]

Thanks for the rely.
You mean like this?
json {
source => "key1", "key2", "key3"
target => "data"
}

[Badger]

The source option should point to a field that contains the JSON string.

[John_snow (John)]

{"key1": "value1", "key2": "value2", "key3": {"key4": "value4"}}

in my case i'm getting event as follow and i wanted to put whole inside the data field

[Badger]

Can you show what your event looks like in

output { stdout { codec => rubydebug } }

and also what you want it to look like.

[zx8086]

@John_snow

'{"key1": "value1", "key2": "value2", "key3": {"key4": "value4"}}'

Does encasing it in single quotes work ?

[Mustafa_NAJIB (Mustafa)]

Hello,

This is your input data :
{"key1": "value1", "key2": "value2", "key3": {"key4": "value4"}}

the new filter to resolve your problem :

filter {
		json {
			source => "message"
		}
		
		mutate {			
			add_field => { "new_filed" => "new_value" }
		}
}

your output the same (in your post)

{
  "key1": "value1",
  "key2": "value2",
  "key3": {
    "key4": "value4"
  },
  "new_filed": "new_value"
}