Json Target doesn't work


I am using logstash 7.3.1.

I use an http input plugin to get data into logstash. I get an JSON payload which looks like

{"version":"1.1","host":"myHost","short_message":"Test Dev","full_message":"Testlog Message for Elastic","level":1,"_server_name":"localhost","_server_ip":"","_server_apppool":"FSCPool","_user_id":"xx\\yyyy","_coo_env":"123456","_level_name":"INFO","_url_args":"&cx=Y52EHGmnn-PiUVV2&tz=-60&xhr=1"}

Based on the attribute "host" in the Json I have to do some logic, the problem seems that the input plugin already provides a field named "host".
In case I use the json plugin as followed, the information from the input json (except the host attribute) is available. The host field still contains the value from the http input.

json {
		source => "message"

I came accross the target parameter in the json plugin
json {
source => "message"
target => "parsed_json"

As it is indicated in the documentation the parsed information should not be placed in the root but in the "parsed_json".
Basically the json is parsed correctly (except the host) but all information are placed in the root and not in "parsed_json"

Is there something I have overlooked or did I missunderstood something?

Beside the issue with the target - is there another solution for my duplicate host problem?
I also tried to remove, rename,... the host field from the input but nothing changed.

Thanks in advance for your help

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.