i have event coming in my logstash as a json
{"key1": "value1", "key2": "value2", "key3": {"key4": "value4"}}
I wanted too put that event inside a key data like
{"data" : {
"key1": "value1",
"key2": "value2",
"key3": {"key4": "value4"}
}
}
But not sure how i can do that in logstash.
Also i wanted add new fields in the event as
{
"data" : {
"key1": "value1",
"key2": "value2",
"key3": {
"key4": "value4"
}
},
"new_filed": "new_value"
}
Badger
October 8, 2021, 8:51pm
2
You could parse the JSON with a json filter and use the target option to put it into a field.
To add new fields you can use the common option add_field that works on all filters.
Thanks for the rely.
You mean like this?
json {
source => "key1", "key2", "key3"
target => "data"
}
Badger
October 11, 2021, 4:54pm
4
The source option should point to a field that contains the JSON string.
{"key1": "value1", "key2": "value2", "key3": {"key4": "value4"}}
in my case i'm getting event as follow and i wanted to put whole inside the data field
Badger
October 11, 2021, 11:01pm
6
Can you show what your event looks like in
output { stdout { codec => rubydebug } }
and also what you want it to look like.
zx8086
October 11, 2021, 11:32pm
7
Does encasing it in single quotes work ?
Hello,
This is your input data :
{"key1": "value1", "key2": "value2", "key3": {"key4": "value4"}}
the new filter to resolve your problem :
filter {
json {
source => "message"
}
mutate {
add_field => { "new_filed" => "new_value" }
}
}
your output the same (in your post)
{
"key1": "value1",
"key2": "value2",
"key3": {
"key4": "value4"
},
"new_filed": "new_value"
}
system
(system)
Closed
November 10, 2021, 9:22am
9
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.