JSON Split

Elastic Stack Logstash
1

Hi,

below is my Json, can you please help to split, I want all details from "Value" as separate event in elasticsearch.

{
    "@odata.context": "https://urlrequired/api/$metadata#Robots",
    "@odata.count": 116,
    "value": [
        {
            "LicenseKey": null,
            "MachineName": "NLUIPACN019",
            "MachineId": 4,
            "Name": "Goal_Robo1",
            "Username": "ww123\\A7XXXX",
            "Description": "ZerXXXRobo1",
            "Version": "19.10.1.0",
            "Type": "Unattended",
            "HostingType": "Standard",
            "Password": null,
            "CredentialType": null,
            "RobotEnvironments": "_Env",
            "Id": 23,
            "ExecutionSettings": null
        },
        {
            "LicenseKey": null,
            "MachineName": "XXXXXX019",
            "MachineId": 4,
            "Name": "Goal_Robo2",
            "Username": "ww930\\A702288",
            "Description": "ZerXX_robo2",
            "Version": "19.10.1.0",
            "Type": "Unattended",
            "HostingType": "Standard",
            "Password": null,
            "CredentialType": null,
            "RobotEnvironments": "XXXXXo_Env",
            "Id": 24,
            "ExecutionSettings": null
        },
        {
            "LicenseKey": null,
            "MachineName": "XXXXXXX019",
            "MachineId": 4,
            "Name": "Goal_Robo4",
            "Username": "ww123\\A702XXX1",
            "Description": "ZerXXXobo4",
            "Version": "19.10.1.0",
            "Type": "Unattended",
            "HostingType": "Standard",
            "Password": null,
            "CredentialType": null,
            "RobotEnvironments": "XXXXRbo_Env",
            "Id": 25,
            "ExecutionSettings": null
        },
        {
            "LicenseKey": null,
            "MachineName": "XXXXXX019",
            "MachineId": 4,
            "Name": "DDDDobo3",
            "Username": "ww212\\A7XXXX",
            "Description": "XXXXrobo3",
            "Version": "19.10.1.0",
            "Type": "Unattended",
            "HostingType": "Standard",
            "Password": null,
            "CredentialType": null,
            "RobotEnvironments": "XXXXXbo_Env",
            "Id": 26,
            "ExecutionSettings": null
        },
        {
            "LicenseKey": null,
            "MachineName": "XXXXXX019",
            "MachineId": 4,
            "Name": "Goal_Robo5",
            "Username": "ww878\\A70SSSS2",
            "Description": "ZXXXXXbo5",
            "Version": "19.10.1.0",
            "Type": "Unattended",
            "HostingType": "Standard",
            "Password": null,
            "CredentialType": null,
            "RobotEnvironments": "DDDDD_Robo_Env",
            "Id": 27,
            "ExecutionSettings": null
        },
        {
            "LicenseKey": null,
            "MachineName": "NXXXXXX19",
            "MachineId": 4,
            "Name": "GOAL_RMG_Robo1",
            "Username": "wwyt0\\A703471",
            "Description": "DFGGRMG_Robo1",
            "Version": "19.10.1.0",
            "Type": "NonProduction",
            "HostingType": "Standard",
            "Password": null,
            "CredentialType": null,
            "RobotEnvironments": "Robo_Env",
            "Id": 31,
            "ExecutionSettings": null
        },
        {
            "LicenseKey": null,
            "MachineName": "NLUIXXXXX019",
            "MachineId": 4,
            "Name": "GOAL_RMG_Robo2",
            "Username": "ww121\\AASA77",
            "Description": "GOALbo2",
            "Version": "19.10.1.0",
            "Type": "NonProduction",
            "HostingType": "Standard",
            "Password": null,
            "CredentialType": null,
            "RobotEnvironments": "GXXXXX_Env",
            "Id": 33,
            "ExecutionSettings": null
        },
        {
            "LicenseKey": null,
            "MachineName": "NLUASASS019",
            "MachineId": 4,
            "Name": "Goal_Robo6",
            "Username": "wx121\\A7WWE59",
            "Description": null,
            "Version": "19.10.1.0",
            "Type": "NonProduction",
            "HostingType": "Standard",
            "Password": null,
            "CredentialType": null,
            "RobotEnvironments": "GxxxxRobo_Env",
            "Id": 142,
            "ExecutionSettings": null
        },
        {
            "LicenseKey": null,
            "MachineName": "Nxxxxx019",
            "MachineId": 4,
            "Name": "GXXXXXmrise1",
            "Username": "wwasss\\AXXX10",
            "Description": "Create/Delete/Scul",
            "Version": "19.10.1.0",
            "Type": "NonProduction",
            "HostingType": "Standard",
            "Password": null,
            "CredentialType": null,
            "RobotEnvironments": "GO_Env",
            "Id": 143,
            "ExecutionSettings": null
        },
        {
            "LicenseKey": null,
            "MachineName": "NLUISSSSSSS",
            "MachineId": 4,
            "Name": "GOAL_SAAAAise2",
            "Username": "wwqwq\\A7XXX8",
            "Description": "Change",
            "Version": "19.10.1.0",
            "Type": "NonProduction",
            "HostingType": "Standard",
            "Password": null,
            "CredentialType": null,
            "RobotEnvironments": "GSsSS_Env",
            "Id": 144,
            "ExecutionSettings": null
        }
    ]
}

below is my config

input {
 file {
   	start_position => "beginning"
   	path => "C:/ELK/logstash/logstash/bin/JsonData.log"
}
}
filter {
 json { source =>"message"
      }
split {
	field => "[value]"
	}
mutate {
	remove_field => ["message","@timestamp","path","host"]
}
}
output {
	elasticsearch
	{
	 	hosts => "http://localhost:9200"
	 	index => "demo-json-split"
	}
stdout{}
}

Thanks in advance!!

2

The split filter should be splitting the event into 10 events, each having a [value] field containing one of the entries from the array. Are you getting 10 events in elasticsearch. If so what do you not like about those events?

3

@Badger,

Thanks for your response, after execution of config I stuck on below screen.

image
image1349×260 15.7 KB

4

There is no error there, what makes you think you have a problem?

5

It's very difficult to understand for me why execution stuck on above screen almost (1 hour on same screen). I will check on different environment and will come back to you..

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.